Google Cloud Professional Cloud Security Engineer Practice Exam

Which product should be used for DDoS protection while meeting compliance requirements for known good CIDR traffic?

1. Cloud Functions

2. Cloud Armor

3. Cloud CDN

4. Cloud Load Balancing

The correct answer is: Cloud Armor

Cloud Armor is specifically designed to provide DDoS protection while ensuring compliance requirements, particularly for environments that need to manage and secure traffic based on known good CIDR ranges. It uses a set of security policies to protect applications from various types of attacks, including DDoS. In the context of managing traffic based on "known good" CIDR blocks, Cloud Armor allows for advanced configurations to permit or deny traffic based on specific IP ranges, which is critical for maintaining security compliance. This capability helps organizations to create a shield around their sensitive applications by allowing only trusted traffic to reach them while blocking potential threats. Other products mentioned do not specialize in this combination of DDoS protection and compliance with CIDR-based access control. For example, Cloud Functions is suited for handling serverless functions and does not provide network-level protection against DDoS attacks. Cloud CDN focuses on caching static content to improve performance rather than protecting against DDoS. Cloud Load Balancing provides scalability and distributes traffic efficiently but lacks the specific features for security policy enforcement against DDoS attacks. Thus, the choice of Cloud Armor is appropriate for environments that require robust DDoS defense along with compliance measures for known traffic sources.