Cloud Digital Leader Google Cloud Security Practice Question
An organization wants to protect its web application from DDoS attacks and SQL injection. Which Google Cloud service should they deploy?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Armor
Cloud Armor provides DDoS protection and Web Application Firewall (WAF) capabilities to block attacks like SQL injection. Cloud IDS is for intrusion detection. Security Command Center is for vulnerability management. Cloud DNS is for DNS resolution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud DNS
Why it's wrong here
Cloud DNS is a global, scalable DNS resolution service that translates domain names to IP addresses but does not inspect HTTP traffic or application-layer payloads. It cannot mitigate DDoS attacks targeting the web application or filter SQL injection attempts because its role is purely naming and resolution, not security enforcement. Even with DNSSEC, it only protects DNS data integrity, not the application's requests or responses.
- ✗
Security Command Center
Why it's wrong here
Security Command Center is a vulnerability management and threat detection platform that provides centralized visibility into assets, misconfigurations, and potential threats across your GCP environment. It generates findings and recommendations but is not an inline security control, meaning it does not sit in the data path to actively block traffic. As a result, it cannot stop DDoS floods or SQL injection in real time; it alerts on these issues after they have been detected or after the fact.
- ✗
Cloud IDS
Why it's wrong here
Cloud IDS is a managed intrusion detection service that passively monitors network traffic using packet mirroring and threat signatures to detect malicious activity in your VPC. It is designed for east-west traffic inspection and only observes mirrored packets, so it cannot drop or modify traffic to block an attack in real time. Additionally, it lacks application-layer parsing to understand HTTP-level patterns like SQL injection or layer-7 DDoS, making it insufficient as a web application firewall.
- ✓
Cloud Armor
Why this is correct
Cloud Armor is a security policy service for HTTP(S) load balancers that combines both network-layer DDoS protection and a Web Application Firewall (WAF) with Layer 3-7 filtering. It enforces allow/deny rules at the edge, including preconfigured rules for OWASP Top 10 risks such as SQL injection and cross-site scripting, and scales to absorb volumetric DDoS attacks. Because it operates inline on incoming traffic, it actively blocks malicious requests before they ever reach the application, making it the correct choice for protecting a web application from DDoS and SQL injection.
Visual reference
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
SQL
SQL is a standard programming language used to manage, query, and manipulate relational databases by issuing commands like SELECT, INSERT, UPDATE, and DELETE.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.