Cloud Digital Leader Trust and security with Google Cloud Practice Question
A small e-commerce company runs its website on Compute Engine instances behind a Global External HTTP(S) Load Balancer. They are concerned about application-layer DDoS attacks, such as SQL injection and cross-site scripting (XSS), that could compromise customer data and degrade performance. The company wants a managed solution that provides both DDoS protection and web application firewall (WAF) capabilities without requiring constant manual updates. They have a limited budget and prefer a solution that is easy to configure and does not require extensive infrastructure changes. What should they implement?
⚠ Common exam trap
Test-takers frequently confuse network-layer security tools (VPC firewall rules, Cloud NAT, Cloud VPN) with application-layer security, assuming any Google Cloud networking feature can block web attacks, but only Cloud Armor provides managed WAF and DDoS protection at the application layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Cloud Armor with preconfigured WAF rules and configure it on the load balancer.
Cloud Armor is a managed, Google Cloud-native service that provides both DDoS protection and a web application firewall (WAF) with preconfigured rules for SQL injection and XSS. It integrates directly with the Global External HTTP(S) Load Balancer, requires no manual updates (rules are maintained by Google), and is cost-effective because it charges based on policy usage rather than infrastructure overhead. This meets the company's need for easy configuration, minimal infrastructure changes, and managed security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Cloud Armor with preconfigured WAF rules and configure it on the load balancer.
Why this is correct
Cloud Armor is a Google Cloud managed security service that provides DDoS protection and a web application firewall (WAF). By enabling preconfigured WAF rules and attaching Cloud Armor policies to the external load balancer, the service inspects incoming HTTP(S) traffic at the edge, blocking common application-layer attacks such as SQL injection and cross-site scripting (XSS) before they reach backend instances. This is exactly what the e-commerce site needs for L7 protection and volumetric attack mitigation.
- ✗
Configure VPC firewall rules to block suspicious IP addresses.
Why it's wrong here
VPC firewall rules are stateful filters that operate at the network and transport layers (IP addresses, ports, and protocols), so they cannot inspect application-layer payloads or detect threats like SQL injection or cross-site scripting. While they can block specific IP addresses, they provide no DDoS protection because they cannot distinguish legitimate distributed traffic from an attack, and manually maintaining block lists is not a scalable or effective defense for a public web workload.
- ✗
Set up Cloud NAT to route all traffic through a single IP address.
Why it's wrong here
Cloud NAT (Network Address Translation) is designed to let instances with no external IP addresses make outbound connections to the internet, performing source NAT for egress traffic. It does not handle inbound user traffic to the load balancer, offers no DDoS protection, and cannot inspect or filter application-layer requests. Routing traffic through a single IP via Cloud NAT would not mitigate volumetric or application attacks and would actually only apply to outbound flows.
- ✗
Use Cloud VPN to connect users to the load balancer.
Why it's wrong here
Cloud VPN establishes encrypted IPsec tunnels between on-premises networks or remote users and your VPC, ensuring confidentiality for data in transit. It does not front the public web application, nor does it provide any WAF capabilities or DDoS mitigation; it simply extends your network. Users connecting through a VPN would still send plaintext HTTP requests that are not inspected for malicious payloads, so this offers no real security benefit for the e-commerce site.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Denial-of-service
A Denial-of-service (DoS) attack is an attempt to make a computer, network, or online service unavailable to its intended users by overwhelming it with fake traffic or requests.
Key term
SQL injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database, often to read, modify, or destroy data.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.