Cloud Digital Leader Google Cloud Security Practice Question
A company wants to protect its web application running on Google Cloud from DDoS attacks and SQL injection. Which service should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Armor
Cloud Armor provides DDoS protection and WAF capabilities (including SQL injection prevention). Cloud CDN caches content but does not protect against attacks. VPC firewall rules are network-level only. reCAPTCHA protects against bots but not SQL injection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
reCAPTCHA Enterprise
Why it's wrong here
reCAPTCHA Enterprise is a bot-management service that uses risk analysis and behavioral signals to distinguish human users from automated clients. It does not inspect HTTP request payloads for SQL injection or cross-site scripting patterns, nor does it provide signature-based WAF rules or absorb large-scale DDoS floods. For this reason, it can be part of a layered defense against credential-stuffing bots, but it cannot protect the web application from OWASP Top 10 exploits or volumetric distributed denial-of-service.
- ✓
Cloud Armor
Why this is correct
Cloud Armor is Google Cloud's DDoS protection and web application firewall (WAF) service. It enforces L7 filtering rules—such as the OWASP ModSecurity Core Rule Set for SQLi and XSS, rate limiting, and custom expressions—at the edge of Google's global load balancing and Cloud CDN infrastructure. In addition, it provides always-on network-layer DDoS mitigation, making it the correct answer for protecting a GKE-hosted web app. It can be configured with preconfigured rules or tailored to block specific attack signatures.
- ✗
Cloud CDN
Why it's wrong here
Cloud CDN is a content delivery network that caches static assets at distributed points of presence to reduce latency and backend resource load. It does not terminate TLS, inspect application-layer payloads, or make allow/deny decisions based on HTTP content; it simply forwards requests that miss the cache to the origin. While it can indirectly dampen some reflected amplification attacks by serving cached responses, it is not a security control and cannot filter SQL injection or other application-layer attacks.
- ✗
VPC firewall rules
Why it's wrong here
VPC firewall rules are stateful packet filters that operate at the network and transport layers (IP addresses, ports, and protocols). They are evaluated for every packet entering or leaving a VPC network, but they do not have visibility into application-layer data—such as HTTP body content—needed to detect SQL injection or cross-site scripting. Their primary purpose is to enforce network segmentation and access control, so they cannot serve as a web application firewall.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
Key term
WAF
A Web Application Firewall (WAF) is a security tool that filters, monitors, and blocks HTTP traffic to and from a web application to protect it from common attacks.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.