Cloud Digital Leader Google Cloud Security Practice Question
A company wants to protect its web application from common web exploits like SQL injection and cross-site scripting. They also need to block traffic from known malicious IP addresses. Which Google Cloud service should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Armor
Cloud Armor provides WAF capabilities to protect against web exploits and DDoS, and can block traffic based on IP reputation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security Command Center
Why it's wrong here
Security Command Center is Google Cloud's security and risk management platform, offering continuous vulnerability scanning, asset discovery, and compliance audits. It identifies misconfigurations and weaknesses in your cloud environment but does not sit inline at the edge of your application. It provides visibility and remediation guidance, not real-time blocking of malicious HTTP requests.
- ✗
reCAPTCHA Enterprise
Why it's wrong here
reCAPTCHA Enterprise uses risk scoring based on user interactions to differentiate humans from automated bots, protecting login forms and transactions from credential stuffing or spam. It does not parse incoming HTTP traffic for exploit signatures like SQL injection or cross-site scripting. Therefore it addresses bot abuse, not the web application layer attacks that Cloud Armor blocks.
- ✗
Cloud IDS
Why it's wrong here
Cloud IDS is a network-based intrusion detection service that inspects VPC east-west traffic for malware and attacker patterns using packet metadata. It operates at the network and transport layers, detecting anomalies like port scanning or C2 communication, but it is not a web application firewall. It cannot evaluate HTTP payloads or block SQLi/XSS within web requests, making it unsuitable for this use case.
- ✓
Cloud Armor
Why this is correct
Cloud Armor is Google Cloud's web application firewall (WAF) that filters HTTP/HTTPS traffic at the edge before it reaches your application. Its pre-configured WAF rules along with custom expressions block common web exploits such as SQL injection, cross-site scripting, and OWASP Top 10 threats. It also supports IP reputation lists, geo-blocking, and DDoS mitigation, delivering real-time protection for public web applications.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
DDoS
A DDoS (Distributed Denial-of-Service) attack is a malicious attempt to disrupt normal traffic of a targeted server, service, or network by overwhelming it with a flood of internet traffic from multiple compromised systems.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.