Cloud Digital Leader Google Cloud Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud IDS

  Why it's wrong here

  Cloud IDS is a network-based threat detection service that uses packet mirroring to inspect traffic for known signatures and anomalous behavior. It operates passively and does not sit in the traffic path, so it cannot block or scrub DDoS floods. It also does not perform deep HTTP payload inspection for SQL injection; that requires an in-line WAF such as Cloud Armor. Thus, while it provides valuable visibility and alerting, it is not the correct protection against these specific application-layer threats.

• ✗

  reCAPTCHA Enterprise

  Why it's wrong here

  reCAPTCHA Enterprise is designed to distinguish between human and automated traffic using risk signals and challenge mechanisms. It is effective against bot-driven abuse like credential stuffing, account takeover, and fake account creation, but it does not analyze HTTP request bodies for SQL injection payloads. It also has no capability to absorb or filter volumetric DDoS attacks because it is not an edge network protection layer. Therefore, it complements but does not replace a WAF/DDoS solution like Cloud Armor.

• ✓

  Cloud Armor

  Why this is correct

  Cloud Armor is the correct choice because it combines distributed denial-of-service (DDoS) protection with a web application firewall (WAF) at the Google Cloud edge. It offers preconfigured rules for the OWASP Top 10, including SQL injection (SQLi) and cross-site scripting (XSS), and can enforce these rules inline as traffic passes through Cloud Load Balancing. Cloud Armor also provides adaptive protection, rate limiting, and edge security policies to mitigate volumetric DDoS attacks. This dual capability directly addresses both the DDoS and SQL injection threats described in the scenario.

• ✗

  VPC firewall rules

  Why it's wrong here

  VPC firewall rules are stateful network-level controls that allow or deny traffic based on source/destination IP, port, and protocol, operating at layers 3 and 4 of the OSI model. They cannot inspect application-layer payloads or HTTP headers, so a SQL injection payload embedded in an HTTP POST request would be forwarded as long as it matches the allow rule for port 80/443. Additionally, VPC firewall rules are not designed to handle large-scale DDoS traffic, which often requires edge-based scrubbing and load balancing. For these reasons, they are insufficient for protecting a web application against the stated threats.

Go deeper

Related to this question