Cloud Digital Leader Google Cloud Products and Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud CDN

  Why it's wrong here

  Cloud CDN is a content delivery network that accelerates access to web content by caching responses at Google's edge locations, but it operates entirely at the HTTP cache layer. It can be configured with cache keys, signed URLs, and TTLs, yet it does not inspect request bodies, headers, or query strings for application-layer attack patterns like SQL injection or cross-site scripting (XSS). Cloud CDN is not a Web Application Firewall (WAF); it is designed for delivery performance, not security posturing, and should be paired with Cloud Armor to block malicious traffic.

• ✗

  VPC firewall rules

  Why it's wrong here

  VPC firewall rules enforce network-level access control by filtering traffic based on source and destination IP addresses, ports, and protocols at layers 3 and 4 of the OSI model. These rules are stateful and can allow or deny traffic to and from VM instances using network tags, but they cannot parse HTTP requests to detect embedded attack payloads such as SQLi or XSS. Since those attacks occur at the application layer, VPC firewall rules are blind to them and would let the malicious HTTP traffic through as long as it matches the permitted network criteria.

• ✗

  Cloud DNS

  Why it's wrong here

  Cloud DNS is a global domain name system service that resolves human-readable hostnames into IP addresses, providing authoritative DNS, zones, and routing policies. It only handles DNS queries and responses; it has no visibility into actual web traffic passing between a client and your application. Therefore, Cloud DNS cannot filter HTTP requests, inspect for SQLi or XSS, or block application-layer attacks, as it simply translates names and returns IP addresses before any HTTP connection is established.

• ✓

  Cloud Armor

  Why this is correct

  Cloud Armor is the correct answer because it is Google Cloud's managed Web Application Firewall (WAF) service that provides application-layer (L7) protection for services behind Cloud Load Balancing. It includes pre-configured rules from the OWASP ModSecurity Core Rule Set, which specifically detects and blocks SQL injection and cross-site scripting patterns in HTTP headers, query parameters, and request bodies. Cloud Armor also offers adaptive protection, rate limiting, and geo-based access controls, making it the appropriate tool for defending a web application against these common web exploits.

Go deeper

Related to this question