Cloud Digital Leader Google Cloud Security Practice Question
A small startup wants to protect its web application from common attacks like SQL injection and cross-site scripting (XSS). They also need DDoS protection. Which Google Cloud security service should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Armor
Cloud Armor provides web application firewall (WAF) rules to block SQL injection and XSS, plus DDoS protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security Command Center
Why it's wrong here
Security Command Center is Google Cloud's security and risk management platform, providing visibility, threat detection, and compliance dashboards across your organization. It aggregates findings from services like Cloud Armor or Cloud IDS, but it does not actively filter or block malicious traffic at the edge. Its role is monitoring and post-incident analysis, not real-time protection against web attacks such as SQL injection or XSS.
- ✗
Cloud IDS
Why it's wrong here
Cloud IDS is a managed network intrusion detection service that inspects network traffic for known threat signatures and anomalies using packet mirroring. It focuses on network-layer and transport-layer activity, and while it can identify some suspicious patterns, it does not natively block traffic and is not designed to parse HTTP payloads for SQL injection or XSS. Application-layer attacks operate over legitimate web requests, which Cloud IDS is not engineered to inspect at the necessary depth to provide protection for a web application.
- ✗
reCAPTCHA Enterprise
Why it's wrong here
reCAPTCHA Enterprise is an anti-abuse service that distinguishes humans from automated bots through risk analysis and interactive challenges. It helps defend against credential stuffing, spam, and fake account creation, but it works at the client side and does not analyze the content of server-bound HTTP requests for malicious payloads. Attackers can craft direct API calls that bypass the reCAPTCHA widget entirely, so it cannot prevent SQL injection or cross-site scripting, which are not bot-driven activities.
- ✓
Cloud Armor
Why this is correct
Cloud Armor is a web application firewall (WAF) and distributed denial-of-service (DDoS) protection service that runs at Google's network edge. It provides preconfigured and customizable rules to block SQL injection, cross-site scripting, and other OWASP Top 10 attack vectors before they reach your application. By integrating with Cloud Load Balancing and offering ML-based adaptive protection, Cloud Armor actively filters malicious requests and safeguards your web application from application-layer and volumetric attacks.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
SQL injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries an application makes to its database, often to read, modify, or destroy data.
Key term
Cross-site scripting
Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, often to steal data or hijack sessions.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.