Cloud Digital Leader Google Cloud Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Security Command Center

  Why it's wrong here

  Security Command Center is Google Cloud's security and risk management platform, providing visibility, threat detection, and compliance dashboards across your organization. It aggregates findings from services like Cloud Armor or Cloud IDS, but it does not actively filter or block malicious traffic at the edge. Its role is monitoring and post-incident analysis, not real-time protection against web attacks such as SQL injection or XSS.

• ✗

  Cloud IDS

  Why it's wrong here

  Cloud IDS is a managed network intrusion detection service that inspects network traffic for known threat signatures and anomalies using packet mirroring. It focuses on network-layer and transport-layer activity, and while it can identify some suspicious patterns, it does not natively block traffic and is not designed to parse HTTP payloads for SQL injection or XSS. Application-layer attacks operate over legitimate web requests, which Cloud IDS is not engineered to inspect at the necessary depth to provide protection for a web application.

• ✗

  reCAPTCHA Enterprise

  Why it's wrong here

  reCAPTCHA Enterprise is an anti-abuse service that distinguishes humans from automated bots through risk analysis and interactive challenges. It helps defend against credential stuffing, spam, and fake account creation, but it works at the client side and does not analyze the content of server-bound HTTP requests for malicious payloads. Attackers can craft direct API calls that bypass the reCAPTCHA widget entirely, so it cannot prevent SQL injection or cross-site scripting, which are not bot-driven activities.

• ✓

  Cloud Armor

  Why this is correct

  Cloud Armor is a web application firewall (WAF) and distributed denial-of-service (DDoS) protection service that runs at Google's network edge. It provides preconfigured and customizable rules to block SQL injection, cross-site scripting, and other OWASP Top 10 attack vectors before they reach your application. By integrating with Cloud Load Balancing and offering ML-based adaptive protection, Cloud Armor actively filters malicious requests and safeguards your web application from application-layer and volumetric attacks.

Go deeper

Related to this question