Cloud Digital Leader Trust and security with Google Cloud Practice Question
A startup is building a web application and wants to protect it from common web attacks like SQL injection and cross-site scripting. Which Google Cloud product provides web application firewall (WAF) capabilities?
⚠ Common exam trap
Many exam-takers confuse network-layer firewalls (Cloud Firewall) with application-layer WAFs (Cloud Armor), leading candidates to choose Option A because both contain 'Firewall' in the name, but they operate at completely different layers of the OSI model.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Armor, which provides WAF rules to detect and block SQL injection, XSS, and other OWASP Top 10 attacks
Cloud Armor is Google Cloud's web application firewall (WAF) service that provides pre-configured rules to detect and block common web attacks, including SQL injection and cross-site scripting (XSS), as well as other OWASP Top 10 threats. It integrates with Cloud Load Balancing and allows you to create custom security policies with rate limiting, IP allow/deny lists, and managed rule sets. This makes it the correct choice for protecting a web application at the application layer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Firewall, which controls network-level traffic based on IP and port rules
Why it's wrong here
Cloud Firewall (VPC firewall rules) controls network traffic based on IP addresses, ports, and protocols. It operates at Layer 3/4 and cannot inspect HTTP request content to detect application-layer attacks like SQL injection or XSS.
- ✓
Cloud Armor, which provides WAF rules to detect and block SQL injection, XSS, and other OWASP Top 10 attacks
Why this is correct
Cloud Armor is Google Cloud's WAF. It includes preconfigured rule sets for OWASP Top 10 vulnerabilities including SQL injection and XSS, and operates at the application layer (Layer 7) where it can inspect HTTP requests. It also provides DDoS protection.
- ✗
VPC Service Controls, which prevent data exfiltration from Google Cloud services
Why it's wrong here
VPC Service Controls are a security perimeter mechanism that restricts access to Google Cloud APIs and services by defining trust boundaries between projects and VPCs. They operate at the identity and API layer, blocking exfiltration of data to unauthorized networks, but they do not inspect HTTP request payloads for malicious patterns like SQL injection or XSS. Because they work at the control plane and data plane API level, they cannot parse application-layer content, making them ineffective as a WAF. Thus, while they are a critical security control, they are not the right tool for detecting OWASP Top 10 application-layer attacks.
- ✗
Security Command Center, which detects security misconfigurations across Google Cloud resources
Why it's wrong here
Security Command Center is a security and risk management platform that aggregates findings from various GCP services, such as vulnerability scans, misconfiguration detection, and threat detection. It provides visibility into compliance and security posture across an organization, but it does not sit inline in front of web traffic and cannot inspect or filter individual HTTP requests. Its role is to identify issues after the fact or in near-real time, not to block attacks at the request level. Therefore, it is not a replacement for a web application firewall (WAF) like Cloud Armor.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
XSS
Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.