Cloud Digital Leader Practice Question: Google Cloud products, services, and solutions
A startup's web application is being targeted by a denial-of-service attack that is flooding its servers with millions of fake requests per second. Which Google Cloud product provides automatic DDoS protection for the application?
⚠ Common exam trap
The GCDL exam often tests the misconception that any 'cloud' service (like Cloud Storage or Cloud Monitoring) can handle DDoS by distributing or alerting, when in fact only a dedicated WAF/edge security service like Cloud Armor provides automatic, inline mitigation at the network perimeter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Armor, which provides DDoS protection and WAF capabilities to detect and mitigate volumetric attacks against the application
Cloud Armor is the correct answer because it is Google Cloud's managed DDoS protection and Web Application Firewall (WAF) service. It uses Google's global infrastructure to absorb and filter volumetric attacks (e.g., SYN floods, UDP reflection attacks) at the edge, before traffic reaches the application. It integrates with Cloud Load Balancing to inspect and drop malicious requests based on pre-configured or adaptive rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Storage, by distributing the static content of the application across multiple storage regions
Why it's wrong here
Cloud Storage is an object store for static files such as images, CSS, or JavaScript; it cannot filter or absorb malformed or high-rate requests aimed at dynamic application endpoints. Even if you replicated static assets to multiple regions, the attack targets the application's origin or load balancer, so moving content to other regions does not reduce the incoming request rate at the edge. Cloud Storage does provide DDoS resilience for its own infrastructure, but it offers no programmable WAF or rate-limiting controls to protect your application frontend. The appropriate service for edge DDoS mitigation and WAF is Cloud Armor, not object storage.
- ✓
Cloud Armor, which provides DDoS protection and WAF capabilities to detect and mitigate volumetric attacks against the application
Why this is correct
Cloud Armor is Google Cloud's DDoS mitigation and WAF service. It integrates with Google's global load balancers to absorb volumetric attacks at the edge before they reach backend servers. Its Adaptive Protection feature automatically detects and responds to DDoS patterns in real time.
- ✗
Cloud IAM, by revoking permissions for the IP addresses generating attack traffic
Why it's wrong here
Cloud IAM governs access to Google Cloud resources based on authenticated identities (e.g., service accounts, users) and their granted roles. It has no mechanism to interpret or block raw IP network traffic targeted at an application, because DDoS packets are never authenticated principals. Furthermore, revoking permissions for an IP address would not stop the flood—attackers spoof IPs or use distributed botnets, making IP-based permission revocation both ineffective and outside IAM's scope. Traffic filtering by IP is a function of network security policies (e.g., VPC firewall rules or Cloud Armor), not IAM.
- ✗
Cloud Monitoring, by alerting the team so they can manually scale up servers to absorb the attack
Why it's wrong here
Cloud Monitoring is a telemetry and observability service for metrics, logs, and alerting; it does not intercept or filter incoming traffic. Even with a very fast alert, the operational latency of human-driven autoscaling far exceeds the seconds in which a multi-million RPS volumetric attack overwhelms the origin. Additionally, autoscaling does not reduce the volume of malicious requests at the network edge—it only adds compute capacity that can still be saturated by attack traffic. Effective mitigation requires inline, automated DDoS filtering at the edge, which Cloud Armor provides, not alert-based manual scaling.
Visual reference
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Cloud Load Balancing
Cloud Load Balancing is the process of distributing incoming network traffic across multiple servers or resources in the cloud to ensure no single resource is overwhelmed, improving availability and reliability.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.