Cloud Digital Leader Google Cloud Products and Services Practice Question
An organization needs to apply security policies to protect their web application from DDoS attacks and SQL injection. Which Google Cloud service should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Armor
Cloud Armor is a web application firewall (WAF) that provides DDoS protection and security rules to block threats like SQL injection. Cloud CDN is for content caching. Load Balancing distributes traffic. Cloud NAT is for outbound connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud NAT
Why it's wrong here
Cloud NAT enables instances on a private VPC network to initiate outbound connections to the internet while preventing unsolicited inbound connections. However, it performs only source network address translation and does not inspect or filter traffic for threats such as DDoS attacks or SQL injection. It lacks the application-layer rule evaluation required to enforce security policies, making it unsuitable for this need.
- ✗
Cloud Load Balancing
Why it's wrong here
Cloud Load Balancing distributes incoming network or HTTP traffic across multiple backend instances to optimize performance and reliability. While it operates at layers 4 and 7, its primary function is traffic routing, not security filtering. It does not provide deep packet inspection, rule-based allow/deny logic, or threat detection, and its health checks do not analyze payloads for malicious content. Therefore, it cannot apply the required security policies.
- ✓
Cloud Armor
Why this is correct
Cloud Armor is Google Cloud's web application firewall (WAF) and DDoS protection service, which integrates with Cloud Load Balancing to protect services at the edge. It enables fine-grained security policies based on IP addresses, geographic location, and preconfigured or custom rules that filter OWASP Top 10 threats like SQL injection and cross-site scripting. Cloud Armor also mitigates volumetric DDoS attacks with adaptive protection and scale, making it the correct service for applying security policies.
- ✗
Cloud CDN
Why it's wrong here
Cloud CDN caches static content at Google's edge locations to accelerate content delivery and reduce origin server load. While it can help absorb surges in traffic and provides some basic defenses like cache poisoning prevention, it is not a security enforcement point. It lacks the ability to evaluate application-layer rules or perform deep packet inspection for attacks such as SQL injection, so it cannot fulfill the organization's security policy requirements.
Visual reference
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
Cloud CDN
A Cloud CDN is a network of servers spread around the world that stores copies of your website or app content so it loads faster for users no matter where they are.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.