Cloud Digital Leader Google Cloud Products and Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Cloud Armor

  Why this is correct

  Cloud Armor is the correct choice because it provides web application firewall (WAF) capabilities, DDoS protection, and IP reputation filtering at the global edge, directly integrated with Cloud Load Balancing. It can inspect HTTP(S) traffic, block malicious requests based on Layer 7 attributes like headers and body, and enforce allow/deny lists based on IP addresses and geolocation. This gives the organization precise, policy-based control over incoming traffic before it reaches backend instances.

• ✗

  Cloud CDN

  Why it's wrong here

  Cloud CDN is incorrect for this requirement because it is primarily a content delivery network that caches static and dynamic content at globally distributed edge locations to reduce latency and origin load. While it can help absorb some volumetric DDoS traffic due to its cache footprint, it does not perform security inspection, WAF rule evaluation, or IP reputation filtering. Cloud CDN works alongside Cloud Armor for acceleration and protection, but it cannot replace the security controls needed to filter malicious requests.

• ✗

  VPC firewall rules

  Why it's wrong here

  VPC firewall rules are not the right tool for edge-based DDoS protection or IP reputation filtering because they operate at the instance network interface level, within the VPC, and control traffic based on IP addresses, ports, and protocols. They do not parse HTTP content or evaluate application-layer attributes, and they lack the global scale and edge enforcement point required to stop attacks before they consume network resources. Additionally, firewall rules are often stateful but cannot distinguish between legitimate traffic and a DDoS attack based on reputation or request patterns.

• ✗

  Cloud NAT

  Why it's wrong here

  Cloud NAT is incorrect because it provides outbound-only Internet access for virtual machine instances that do not have external IP addresses, translating their private IPs to a public IP for egress traffic. It does not inspect inbound traffic, apply security policies, or provide DDoS protection—in fact, it is not even applicable to inbound traffic directed at a load-balanced web application. Cloud NAT is purely a connectivity service, not a security or filtering service, so it cannot meet the organization's requirement for edge security.

Go deeper

Related to this question