- A
Cloud Storage, by distributing the static content of the application across multiple storage regions
Why wrong: Cloud Storage serves static content but provides no DDoS protection mechanism against attack traffic targeting the application.
- B
Cloud Armor, which provides DDoS protection and WAF capabilities to detect and mitigate volumetric attacks against the application
Cloud Armor is Google Cloud's DDoS mitigation and WAF service. It integrates with Google's global load balancers to absorb volumetric attacks at the edge before they reach backend servers. Its Adaptive Protection feature automatically detects and responds to DDoS patterns in real time.
- C
Cloud IAM, by revoking permissions for the IP addresses generating attack traffic
Why wrong: Cloud IAM controls access to Google Cloud resources through authentication and authorization. It operates on authenticated principals, not arbitrary external IP addresses. It cannot block DDoS attack traffic.
- D
Cloud Monitoring, by alerting the team so they can manually scale up servers to absorb the attack
Why wrong: Cloud Monitoring detects and alerts but doesn't mitigate attacks. Manual scaling in response to a multi-million RPS attack is too slow. Automatic DDoS mitigation at the network edge (Cloud Armor) is required.
Quick Answer
The answer is Cloud Armor, which provides automatic DDoS protection for web applications on Google Cloud. This service combines a Web Application Firewall (WAF) with Google’s global edge network to absorb and filter volumetric attacks like SYN floods or UDP reflection attacks before they reach your application servers, inspecting traffic against pre-configured or adaptive rules. On the Google Cloud Digital Leader exam, this question tests your understanding of how Cloud Armor integrates with Cloud Load Balancing to defend against Layer 3 and Layer 4 attacks, often contrasting it with solutions like Cloud CDN or VPC Firewall Rules that lack built-in DDoS mitigation. A common trap is confusing Cloud Armor with Cloud IDS, but remember: Armor stops floods at the edge, while IDS monitors internal traffic. Memory tip: think “Armor shields the edge” to recall its role in absorbing volumetric attacks at Google’s network perimeter.
Cloud Digital Leader Practice Question: Google Cloud products, services, and solutions
This GCDL practice question tests your understanding of google cloud products, services, and solutions. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A startup's web application is being targeted by a denial-of-service attack that is flooding its servers with millions of fake requests per second. Which Google Cloud product provides automatic DDoS protection for the application?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Cloud Armor, which provides DDoS protection and WAF capabilities to detect and mitigate volumetric attacks against the application
Cloud Armor is the correct answer because it is Google Cloud's managed DDoS protection and Web Application Firewall (WAF) service. It uses Google's global infrastructure to absorb and filter volumetric attacks (e.g., SYN floods, UDP reflection attacks) at the edge, before traffic reaches the application. It integrates with Cloud Load Balancing to inspect and drop malicious requests based on pre-configured or adaptive rules.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Storage, by distributing the static content of the application across multiple storage regions
Why it's wrong here
Cloud Storage serves static content but provides no DDoS protection mechanism against attack traffic targeting the application.
- ✓
Cloud Armor, which provides DDoS protection and WAF capabilities to detect and mitigate volumetric attacks against the application
Why this is correct
Cloud Armor is Google Cloud's DDoS mitigation and WAF service. It integrates with Google's global load balancers to absorb volumetric attacks at the edge before they reach backend servers. Its Adaptive Protection feature automatically detects and responds to DDoS patterns in real time.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Cloud IAM, by revoking permissions for the IP addresses generating attack traffic
Why it's wrong here
Cloud IAM controls access to Google Cloud resources through authentication and authorization. It operates on authenticated principals, not arbitrary external IP addresses. It cannot block DDoS attack traffic.
- ✗
Cloud Monitoring, by alerting the team so they can manually scale up servers to absorb the attack
Why it's wrong here
Cloud Monitoring detects and alerts but doesn't mitigate attacks. Manual scaling in response to a multi-million RPS attack is too slow. Automatic DDoS mitigation at the network edge (Cloud Armor) is required.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the misconception that any 'cloud' service (like Cloud Storage or Cloud Monitoring) can handle DDoS by distributing or alerting, when in fact only a dedicated WAF/edge security service like Cloud Armor provides automatic, inline mitigation at the network perimeter.
Detailed technical explanation
How to think about this question
Cloud Armor uses Google's global anycast network to absorb DDoS traffic at the edge, leveraging techniques like TCP SYN cookie validation and rate limiting per source IP. It supports pre-configured rules for OWASP Top 10 threats and can be combined with Cloud Load Balancing's 'Google Cloud Armor Managed Protection Plus' tier for dedicated mitigation capacity. In a real-world scenario, a 1 Tbps UDP amplification attack would be dropped at Google's edge PoPs before reaching the application's backend instances.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Google Cloud products, services, and solutions — study guide chapter
Learn the concepts, then practise the questions
- →
Google Cloud products, services, and solutions practice questions
Targeted practice on this topic area only
- →
All GCDL questions
507 questions across all exam domains
- →
Google Cloud Digital Leader study guide
Full concept coverage aligned to exam objectives
- →
GCDL practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related GCDL practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Why cloud technology is transforming business practice questions
Practise GCDL questions linked to Why cloud technology is transforming business.
Fundamental cloud concepts practice questions
Practise GCDL questions linked to Fundamental cloud concepts.
Google Cloud products, services, and solutions practice questions
Practise GCDL questions linked to Google Cloud products, services, and solutions.
Scaling with Google Cloud operations practice questions
Practise GCDL questions linked to Scaling with Google Cloud operations.
Trust and security with Google Cloud practice questions
Practise GCDL questions linked to Trust and security with Google Cloud.
GCDL fundamentals practice questions
Practise GCDL questions linked to GCDL fundamentals.
GCDL scenario practice questions
Practise GCDL questions linked to GCDL scenario.
GCDL troubleshooting practice questions
Practise GCDL questions linked to GCDL troubleshooting.
Practice this exam
Start a free GCDL practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this GCDL question test?
Google Cloud products, services, and solutions — This question tests Google Cloud products, services, and solutions — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Cloud Armor, which provides DDoS protection and WAF capabilities to detect and mitigate volumetric attacks against the application — Cloud Armor is the correct answer because it is Google Cloud's managed DDoS protection and Web Application Firewall (WAF) service. It uses Google's global infrastructure to absorb and filter volumetric attacks (e.g., SYN floods, UDP reflection attacks) at the edge, before traffic reaches the application. It integrates with Cloud Load Balancing to inspect and drop malicious requests based on pre-configured or adaptive rules.
What should I do if I get this GCDL question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more ways this is tested on GCDL
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company's web application faces DDoS attacks and SQL injection attempts from the internet. They need a service that sits in front of their load balancer to block malicious traffic before it reaches their application servers. Which Google Cloud service provides this protection?
medium- A.Cloud Firewall (VPC firewall rules)
- ✓ B.Cloud Armor
- C.Cloud VPN
- D.Cloud Identity-Aware Proxy (IAP)
Why B: Cloud Armor is Google Cloud's web application firewall (WAF) and DDoS mitigation service that operates at the edge of Google's network, in front of the load balancer. It can filter incoming traffic based on Layer 7 rules (e.g., SQL injection patterns, cross-site scripting) and Layer 3/4 conditions (e.g., IP reputation, rate limiting), blocking malicious requests before they reach the load balancer or application servers. This makes it the correct choice for protecting against both DDoS attacks and SQL injection attempts at the network perimeter.
Last reviewed: Jun 11, 2026
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.