Your team is developing an application that will be used by consumers all over the world. Currently, the application sits behind a global external…

The correct answer is C because it meets the requirement of protecting the application from

potential application-level attacks. Google Cloud Armor security policies are sets of rules that match

on attributes from Layer 3 to Layer 7 to protect externally facing applications1. Web application

firewall (WAF) rules are predefined rules that detect and mitigate common web attacks such as cross-

site scripting (XSS), SQL injection, remote file inclusion, and more2. By applying a Google Cloud

Armor security policy with WAF rules to the backend service, you can filter out malicious requests

before they reach your application.

Option A is incorrect because Cloud CDN is a content delivery network that caches static content at

the edge of Google’s network, but it does not provide any protection against application-level

attacks3. Option B is incorrect because firewall rules are applied at the VPC network level, not at the

load balancer level4. Firewall rules also only match on Layer 3 and 4 attributes, not on Layer 7

attributes that are relevant for application-level attacks4. Option D is incorrect because VPC Service

Controls perimeter is a feature that helps you secure your data from unauthorized access by users

outside your organization, but it does not protect your application from external attacks.

Security policy overview | Google Cloud Armor

Web application firewall (WAF) rules | Google Cloud Armor

Cloud CDN overview | Google Cloud

Using firewall rules | VPC

[VPC Service Controls overview | Google Cloud]