Cloud Digital Leader Google Cloud Security Practice Question
A company wants to protect its web application deployed on Google Cloud from OWASP Top 10 attacks and also block traffic from specific geographic regions. Which TWO services should they use together? (Choose 2)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud CDN
Cloud Armor provides WAF rules for OWASP Top 10 and geo-blocking. Cloud CDN caches content and can be used with Cloud Armor for edge protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Load Balancing
Why it's wrong here
Cloud Load Balancing simply distributes incoming traffic across backend instances based on health checks and capacity; it has no awareness of HTTP request payloads or application-layer attack signatures. Because it lacks any WAF capability, it cannot filter OWASP Top 10 threats like SQL injection or XSS, so it would not directly protect the application from such attacks.
- ✓
Cloud CDN
Why this is correct
Cloud CDN serves as a caching layer that shields backend origins by absorbing requests and can deliver cached content globally with low latency. When integrated with Cloud Armor, CDN policies evaluate incoming requests against WAF rules before they reach the origin, making it a valid component in a protection strategy; however, the WAF itself is Cloud Armor, not CDN.
- ✓
Cloud Armor
Why this is correct
Cloud Armor is Google Cloud's Web Application Firewall (WAF) service, offering preconfigured rules that block OWASP Top 10 attacks such as SQL injection, cross-site scripting (XSS), and remote file inclusion. It also enables geo-based blocking to restrict access by location, making it the core application-layer protection service for a web app on GCP.
- ✗
Cloud IDS
Why it's wrong here
Cloud IDS is a network-based intrusion detection system that inspects traffic for known malware and network-level exploits, but it does not analyze application-layer protocols like HTTP for OWASP Top 10 vulnerabilities. Its purpose is to detect and alert on network threats such as port scanning or C2 traffic, not to protect against web application attacks, so it would not meet the OWASP protection requirement.
- ✗
reCAPTCHA Enterprise
Why it's wrong here
reCAPTCHA Enterprise is designed to distinguish human users from automated bots using risk analysis and challenge mechanisms, but it does not inspect HTTP requests for exploit patterns like SQL injection or XSS. While it can stop bots launching attacks, it cannot block a human attacker crafting malicious requests, so it is insufficient for OWASP Top 10 protection.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Cloud CDN
A Cloud CDN is a network of servers spread around the world that stores copies of your website or app content so it loads faster for users no matter where they are.
Key term
Cloud Armor
Cloud Armor is a Google Cloud web application firewall (WAF) service that protects applications and websites from attacks like DDoS and SQL injection using customizable security rules.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.