Cloud Digital Leader Practice Question: Google Cloud products, services, and solutions
A company's web application faces DDoS attacks and SQL injection attempts from the internet. They need a service that sits in front of their load balancer to block malicious traffic before it reaches their application servers. Which Google Cloud service provides this protection?
⚠ Common exam trap
Many candidates confuse Cloud Armor (a WAF/DDoS protection service) with VPC firewall rules (Cloud Firewall), which only provide stateful packet filtering at the network layer and cannot inspect application-layer attacks like SQL injection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Armor
Cloud Armor is Google Cloud's web application firewall (WAF) and DDoS mitigation service that operates at the edge of Google's network, in front of the load balancer. It can filter incoming traffic based on Layer 7 rules (e.g., SQL injection patterns, cross-site scripting) and Layer 3/4 conditions (e.g., IP reputation, rate limiting), blocking malicious requests before they reach the load balancer or application servers. This makes it the correct choice for protecting against both DDoS attacks and SQL injection attempts at the network perimeter.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Firewall (VPC firewall rules)
Why it's wrong here
VPC firewall rules are implemented at the network layer, filtering traffic based on protocol, source/destination IP ranges, and ports — either at the VM NIC or subnetwork level. They can block traffic from suspicious CIDR blocks or restrict exposed ports, but they act on packet headers, not on HTTP body content. As a result, a request containing an SQL injection payload that matches an allowed 5-tuple (e.g., TCP 443 to a web server) passes straight through, and the rules offer no DDoS absorption or application-layer signature inspection.
- ✓
Cloud Armor
Why this is correct
Cloud Armor provides DDoS protection and WAF capabilities at the load balancer edge. It can block volumetric DDoS attacks and inspect HTTP content for SQL injection, XSS, and other OWASP threats before they reach application servers.
- ✗
Cloud VPN
Why it's wrong here
Cloud VPN creates an encrypted IPsec tunnel between an on-premises network or another cloud environment and a VPC, ensuring confidentiality and integrity for traffic in transit. It is a connectivity service — it encrypts and forwards packets based on routing — but it has no ability to inspect HTTP payloads, block malicious patterns, or mitigate DDoS at the edge. Public internet traffic reaching a web app typically does not go through Cloud VPN, so it is irrelevant for protecting against SQL injection or volumetric attacks.
- ✗
Cloud Identity-Aware Proxy (IAP)
Why it's wrong here
Cloud IAP is a zero-trust access control service that authenticates and authorizes individual user identities before letting them reach a service, typically using SSO/OAuth and issuing verified JWT sessions. It can enforce context-aware policies like device security status or source IP, but it does not inspect HTTP request payloads for attack patterns such as SQLi or XSS, nor does it absorb large volumetric DDoS traffic. IAP answers "who may access", not "is this traffic safe".
Visual reference
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
SQL
SQL is a standardized programming language used to manage and manipulate relational databases, enabling querying, updating, and data retrieval.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.