← GCDL·Google Cloud

Question 2 of 507

Trust and security with Google Cloud →easyMultiple ChoiceObjective-mapped

Quick Answer

The answer is Cloud Armor, which provides Google Cloud’s web application firewall (WAF) capabilities for protecting against web attacks like SQL injection and cross-site scripting. This is correct because Cloud Armor offers pre-configured WAF rules that detect and block OWASP Top 10 threats, including SQLi and XSS, by inspecting HTTP/S traffic at the application layer when integrated with Cloud Load Balancing. On the Google Cloud Digital Leader exam, this question tests your understanding of which service handles application-layer security versus network-layer tools like Cloud Firewall; a common trap is confusing Cloud Armor with Cloud CDN or IAM, but remember that Cloud Armor is specifically the WAF product for web attack protection. A helpful memory tip is to think of “Armor” as the protective shield for your web app—just as armor blocks physical attacks, Cloud Armor blocks SQL injection and XSS at the edge.

Cloud Digital Leader Trust and security with Google Cloud Practice Question

This GCDL practice question tests your understanding of trust and security with google cloud. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A startup is building a web application and wants to protect it from common web attacks like SQL injection and cross-site scripting. Which Google Cloud product provides web application firewall (WAF) capabilities?

Question 1easymultiple choice

Full question →

A
Cloud Firewall, which controls network-level traffic based on IP and port rules
Why wrong: Cloud Firewall (VPC firewall rules) controls network traffic based on IP addresses, ports, and protocols. It operates at Layer 3/4 and cannot inspect HTTP request content to detect application-layer attacks like SQL injection or XSS.
B
Cloud Armor, which provides WAF rules to detect and block SQL injection, XSS, and other OWASP Top 10 attacks
Cloud Armor is Google Cloud's WAF. It includes preconfigured rule sets for OWASP Top 10 vulnerabilities including SQL injection and XSS, and operates at the application layer (Layer 7) where it can inspect HTTP requests. It also provides DDoS protection.
C
VPC Service Controls, which prevent data exfiltration from Google Cloud services
Why wrong: VPC Service Controls protect Google Cloud API services from unauthorized access and data exfiltration between projects. They don't inspect web application traffic for SQL injection or XSS attacks.
D
Security Command Center, which detects security misconfigurations across Google Cloud resources
Why wrong: Security Command Center provides security findings, threat detection, and vulnerability scanning for cloud configurations. It is not a WAF and does not inspect individual HTTP requests for application-layer attacks.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Cloud Armor, which provides WAF rules to detect and block SQL injection, XSS, and other OWASP Top 10 attacks

Cloud Armor is Google Cloud's web application firewall (WAF) service that provides pre-configured rules to detect and block common web attacks, including SQL injection and cross-site scripting (XSS), as well as other OWASP Top 10 threats. It integrates with Cloud Load Balancing and allows you to create custom security policies with rate limiting, IP allow/deny lists, and managed rule sets. This makes it the correct choice for protecting a web application at the application layer.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Cloud Firewall, which controls network-level traffic based on IP and port rules
Why it's wrong here
Cloud Firewall (VPC firewall rules) controls network traffic based on IP addresses, ports, and protocols. It operates at Layer 3/4 and cannot inspect HTTP request content to detect application-layer attacks like SQL injection or XSS.
✓
Cloud Armor, which provides WAF rules to detect and block SQL injection, XSS, and other OWASP Top 10 attacks
Why this is correct
Cloud Armor is Google Cloud's WAF. It includes preconfigured rule sets for OWASP Top 10 vulnerabilities including SQL injection and XSS, and operates at the application layer (Layer 7) where it can inspect HTTP requests. It also provides DDoS protection.
Related concept
Read the scenario before looking for a memorised answer.
✗
VPC Service Controls, which prevent data exfiltration from Google Cloud services
Why it's wrong here
VPC Service Controls protect Google Cloud API services from unauthorized access and data exfiltration between projects. They don't inspect web application traffic for SQL injection or XSS attacks.
✗
Security Command Center, which detects security misconfigurations across Google Cloud resources
Why it's wrong here
Security Command Center provides security findings, threat detection, and vulnerability scanning for cloud configurations. It is not a WAF and does not inspect individual HTTP requests for application-layer attacks.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is confusing network-layer firewalls (Cloud Firewall) with application-layer WAFs (Cloud Armor), leading candidates to choose Option A because both contain 'Firewall' in the name, but they operate at completely different layers of the OSI model.

Trap categories for this question

Command / output trap
Security Command Center provides security findings, threat detection, and vulnerability scanning for cloud configurations. It is not a WAF and does not inspect individual HTTP requests for application-layer attacks.

Detailed technical explanation

How to think about this question

Cloud Armor uses a rules engine that evaluates HTTP(S) requests against managed rule sets (e.g., modsecurity-based OWASP CRS) and custom rules written in Common Expression Language (CEL). It operates at the edge of Google's network, inspecting traffic before it reaches your backend instances, which reduces load and latency. A real-world scenario is using Cloud Armor with rate limiting to mitigate DDoS attacks while simultaneously blocking SQL injection patterns in query strings.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related GCDL practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Why cloud technology is transforming business practice questions

Practise GCDL questions linked to Why cloud technology is transforming business.

Fundamental cloud concepts practice questions

Practise GCDL questions linked to Fundamental cloud concepts.

Google Cloud products, services, and solutions practice questions

Practise GCDL questions linked to Google Cloud products, services, and solutions.

Scaling with Google Cloud operations practice questions

Practise GCDL questions linked to Scaling with Google Cloud operations.

Trust and security with Google Cloud practice questions

Practise GCDL questions linked to Trust and security with Google Cloud.

GCDL fundamentals practice questions

Practise GCDL questions linked to GCDL fundamentals.

GCDL scenario practice questions

Practise GCDL questions linked to GCDL scenario.

GCDL troubleshooting practice questions

Practise GCDL questions linked to GCDL troubleshooting.

Practice this exam

Start a free GCDL practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

GCDL practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this GCDL question test?

Trust and security with Google Cloud — This question tests Trust and security with Google Cloud — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Cloud Armor, which provides WAF rules to detect and block SQL injection, XSS, and other OWASP Top 10 attacks — Cloud Armor is Google Cloud's web application firewall (WAF) service that provides pre-configured rules to detect and block common web attacks, including SQL injection and cross-site scripting (XSS), as well as other OWASP Top 10 threats. It integrates with Cloud Load Balancing and allows you to create custom security policies with rate limiting, IP allow/deny lists, and managed rule sets. This makes it the correct choice for protecting a web application at the application layer.

What should I do if I get this GCDL question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.