Cloud Armor for DDoS and WAF in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does Cloud Armor respond to a detected DDoS attack?

When Google Cloud Armor detects a DDoS attack on your service, what is its primary behavior?

A It applies configured security policies to filter and block malicious traffic while allowing legitimate requests.

B It redirects all traffic to a backup server outside Google Cloud.

C It automatically blocks all incoming traffic to the service until the attack stops.

D It shuts down the service to prevent damage and notifies the administrator.

💡 Hint

Think about how a protective filter works rather than stopping everything.

Cloud Armor uses security policies to filter traffic. It blocks harmful requests but lets good traffic through, keeping your service available during attacks.

🧠 Conceptual

intermediate

What is the role of WAF rules in Cloud Armor?

Which best describes the purpose of Web Application Firewall (WAF) rules in Cloud Armor?

A They monitor server CPU usage and send alerts.

B They define patterns to detect and block common web attacks like SQL injection and cross-site scripting.

C They automatically scale the backend servers during high traffic.

D They encrypt all incoming traffic to the application.

💡 Hint

WAF rules look for harmful patterns in web requests.

WAF rules help Cloud Armor identify and block common web attacks by matching request patterns against known attack signatures.

❓ Architecture

advanced

Which architecture best integrates Cloud Armor for protecting a global web application?

You have a global web application hosted on Google Cloud with multiple backend regions. Which architecture best uses Cloud Armor to protect it?

A Apply Cloud Armor policies on the global HTTP(S) Load Balancer to filter traffic before it reaches backends.

B Deploy Cloud Armor policies on each backend VM instance individually.

C Use Cloud Armor only on the primary region's load balancer and rely on firewall rules elsewhere.

D Configure Cloud Armor on the Cloud CDN to cache and block malicious content.

💡 Hint

Think about where traffic first enters your system globally.

Applying Cloud Armor on the global HTTP(S) Load Balancer filters traffic at the edge, protecting all backend regions efficiently.

❓ security

advanced

What happens if a Cloud Armor security policy has conflicting rules for the same IP address?

If a Cloud Armor security policy contains two rules that both match the same IP address but have different actions (one ALLOW, one DENY), what is the effective action?

A The DENY action always overrides ALLOW regardless of rule order.

B The ALLOW action always overrides DENY regardless of rule order.

C Cloud Armor throws an error and blocks all traffic from that IP.

D The first matching rule in priority order is applied, so the action of that rule is enforced.

💡 Hint

Consider how rule priority affects decision making.

Cloud Armor evaluates rules by priority. The first rule that matches the request determines the action, so order matters.

✅ Best Practice

expert

Which practice ensures minimal false positives when using Cloud Armor WAF rules?

To reduce false positives while using Cloud Armor's WAF rules on a critical web application, which practice is best?

A Only use IP-based allowlists and blocklists without WAF rules.

B Enable all predefined WAF rules at once without customization to maximize protection.

C Start with a monitoring mode to log matches, then gradually enable blocking after tuning rules based on logs.

D Disable logging to improve performance and avoid alert fatigue.

💡 Hint

Think about how to safely test rules before blocking traffic.

Starting in monitoring mode lets you see what would be blocked without affecting users. You can tune rules to reduce false positives before enforcing blocking.