6.1 Configuring Google Cloud Armor Policies. Considerations Include: PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice Questions (Page 5)

Questions 21–23

1. 21application · medium

   Your website is being accessed by a bot that is scraping content. The bot is using a headless browser and can execute JavaScript. You want to block this bot while allowing legitimate users. What should you configure in your Cloud Armor policy?

   • AA JavaScript challenge that requires the client to execute JavaScript.
   • BA WAF rule that blocks requests with a user-agent string associated with headless browsers.
   • CA rate limiting rule that blocks IPs that make more than a certain number of requests.
   • DA reCAPTCHA challenge that requires the client to solve a puzzle.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   Your security team wants to automatically block traffic from IP addresses that are known to be malicious according to Google's threat intelligence. You have a Cloud Armor policy attached to your backend service. What should you do?

   • AEnable Google Threat Intelligence in the Cloud Armor policy and add a rule that blocks traffic from the threat intelligence feed.
   • BCreate a firewall rule that blocks traffic from the Google Threat Intelligence feed.
   • CManually add all known malicious IPs to a deny list in the Cloud Armor policy.
   • DUse Cloud IDS to block the malicious IPs.
   Reveal Solution Discussion Select an answer first
3. 23foundation · easy

   What is the primary purpose of advanced network DDoS protection in Cloud Armor?

   • ATo block specific application-layer attacks like SQL injection
   • BTo encrypt traffic between clients and the load balancer
   • CTo protect against volumetric attacks that aim to overwhelm network or application resources
   • DTo enforce identity-based access control on requests
   Reveal Solution Discussion Select an answer first