Cloud Digital Leader Google Cloud Products and Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Cloud Armor

  Why this is correct

  Cloud Armor is Google Cloud's Web Application Firewall (WAF) service that provides edge-based protection against application-layer attacks such as SQL injection and cross-site scripting (XSS). It uses pre-configured rules, including the OWASP Top 10 rule set, as well as custom rules in Common Expression Language (CEL) to filter malicious traffic before it reaches backend instances. Cloud Armor integrates with Cloud Load Balancing and can also provide DDoS protection with adaptive protection and rate limiting. This makes it the correct choice for blocking common web attacks.

• ✗

  Cloud CDN

  Why it's wrong here

  Cloud CDN is a content delivery network that accelerates content delivery by caching static and dynamic content at globally distributed edge points of presence (PoPs). It does not perform deep packet inspection or application-layer filtering, so it cannot detect or block SQL injection or XSS payloads. While Cloud CDN can be paired with Cloud Armor for security, the CDN service itself lacks native WAF capabilities. Therefore, it is not the correct service for blocking common web attacks.

• ✗

  Cloud IDS

  Why it's wrong here

  Cloud IDS (Intrusion Detection System) is a managed network threat detection service that inspects network traffic for signatures of known malware and suspicious activity on the network layer. It operates by mirroring packets and analyzing them against threat intelligence, but it does not act as an inline security control that can block malicious application requests. Since it is designed for network-based threat detection rather than application-layer web attack prevention, it does not provide the WAF functionality required to block SQL injection. Hence, Cloud IDS is not the appropriate service for this use case.

• ✗

  Cloud Load Balancing

  Why it's wrong here

  Cloud Load Balancing distributes incoming traffic across multiple backend instances to ensure high availability and scalability, operating at the transport and application layers for traffic routing. It does not inspect the payload of HTTP requests for malicious patterns, nor does it apply security policies to filter out SQL injection or XSS attempts. While load balancers can forward traffic to security appliances or be integrated with Cloud Armor, they themselves are not a security service. Therefore, Cloud Load Balancing alone cannot block common web attacks.

Go deeper

Related to this question