Cloud Digital Leader Google Cloud Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  reCAPTCHA Enterprise

  Why it's wrong here

  reCAPTCHA Enterprise is a bot-management service that uses risk analysis and behavioral signals to distinguish human users from automated clients. It does not inspect HTTP request payloads for SQL injection or cross-site scripting patterns, nor does it provide signature-based WAF rules or absorb large-scale DDoS floods. For this reason, it can be part of a layered defense against credential-stuffing bots, but it cannot protect the web application from OWASP Top 10 exploits or volumetric distributed denial-of-service.

• ✓

  Cloud Armor

  Why this is correct

  Cloud Armor is Google Cloud's DDoS protection and web application firewall (WAF) service. It enforces L7 filtering rules—such as the OWASP ModSecurity Core Rule Set for SQLi and XSS, rate limiting, and custom expressions—at the edge of Google's global load balancing and Cloud CDN infrastructure. In addition, it provides always-on network-layer DDoS mitigation, making it the correct answer for protecting a GKE-hosted web app. It can be configured with preconfigured rules or tailored to block specific attack signatures.

• ✗

  Cloud CDN

  Why it's wrong here

  Cloud CDN is a content delivery network that caches static assets at distributed points of presence to reduce latency and backend resource load. It does not terminate TLS, inspect application-layer payloads, or make allow/deny decisions based on HTTP content; it simply forwards requests that miss the cache to the origin. While it can indirectly dampen some reflected amplification attacks by serving cached responses, it is not a security control and cannot filter SQL injection or other application-layer attacks.

• ✗

  VPC firewall rules

  Why it's wrong here

  VPC firewall rules are stateful packet filters that operate at the network and transport layers (IP addresses, ports, and protocols). They are evaluated for every packet entering or leaving a VPC network, but they do not have visibility into application-layer data—such as HTTP body content—needed to detect SQL injection or cross-site scripting. Their primary purpose is to enforce network segmentation and access control, so they cannot serve as a web application firewall.

Go deeper

Related to this question