Google PCA Designing for Security and Compliance Practice Question
A company needs to protect an HTTPS load-balanced web application from OWASP Top 10 attacks, including SQL injection and cross-site scripting. Which GCP service should they enable?
⚠ Common exam trap
The trap is confusing Cloud Armor with other GCP services like Cloud CDN or IAP, which serve different purposes (content delivery and access control, respectively).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Armor
Cloud Armor is Google Cloud's web application firewall (WAF) and DDoS protection service that provides protection against OWASP Top 10 attacks, including SQL injection and cross-site scripting. It integrates with external HTTP(S) load balancers to filter malicious traffic at the edge. Enabling Cloud Armor security policies allows you to block or allow requests based on preconfigured WAF rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud NAT
Why it's wrong here
Cloud NAT provides outbound internet connectivity and source address translation for private instances; it does not inspect inbound HTTP requests, so SQL injection and XSS payloads reach the application unfiltered. It is tempting because it is a network-layer service attached to a VPC, but Cloud Armor security policies applied to the load balancer perform the required attack filtering.
- ✗
Cloud CDN
Why it's wrong here
Cloud CDN caches HTTP responses at edge points of presence; it inspects neither request payloads nor SQL or script patterns, so OWASP injection and XSS traffic passes through untouched. It is tempting because it fronts HTTPS load balancers and improves latency, but Cloud Armor is the service that evaluates requests against WAF rules at the load balancer.
- ✗
Identity-Aware Proxy
Why it's wrong here
Identity-Aware Proxy enforces identity and context-based access to backends, authenticating users before requests reach the application; it does not parse request bodies for SQL injection or XSS payloads. It is tempting because it sits in front of HTTPS load balancers, but Cloud Armor's WAF rules provide the OWASP Top 10 filtering required here.
- ✓
Cloud Armor
Why this is correct
Cloud Armor provides web application firewall filtering at the load balancer, inspecting HTTP traffic to block SQL injection and cross-site scripting. This satisfies the requirement to defend the HTTPS application against OWASP Top 10 attacks.
Go deeper
Related to this question
Learn chapter
IAM Policies, Service Accounts, and Auditing
Key term
HTTP
HTTP stands for Hypertext Transfer Protocol, the set of rules web browsers and servers use to communicate and transfer web pages over the internet.
Key term
WAF
A Web Application Firewall (WAF) is a security tool that filters, monitors, and blocks HTTP traffic to and from a web application to protect it from common attacks.
About these practice questions
Courseiva writes every PCA question from scratch — 807 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.