Cloud Armor Study Notes

Cloud Armor is Google Cloud's web application firewall and DDoS protection service, attached to Application Load Balancer backend services to filter HTTP and HTTPS traffic before it reaches your backends. Security policies made of prioritised rules let you allow, deny, or rate-limit requests based on IP, geography, and application-layer signatures.

Key facts

• A Cloud Armor security policy attaches to a backend service of an external Application Load Balancer; it does not attach directly to individual VMs or to Network Load Balancers.
• Rules are evaluated by priority, with the lowest number winning, and every policy ends with a default rule, typically allow, that applies when no earlier rule matches.
• Preconfigured WAF rules provide managed protection against common attacks such as SQL injection, cross-site scripting, local and remote file inclusion, and remote code execution.
• IP allowlists and denylists can be written in CIDR notation, letting you restrict an admin application to office ranges or block known abusive source networks quickly.
• Rate limiting rules can throttle requests per client IP or other keys over a time window, with actions ranging from temporary bans to conforming limits with excess denied.
• Adaptive Protection, a premium capability, uses machine learning to detect anomalous traffic patterns suggestive of Layer 7 DDoS attacks and suggests mitigating rules for review.
• Cloud Armor benefits from Google's edge network for volumetric DDoS absorption, while its Layer 7 rules handle application attacks that raw network filtering cannot interpret.
• Preview mode lets you deploy a rule and see in logs what it would have blocked without enforcing it, which is the safe way to test WAF rules before production rollout.
• Named IP lists and integration with reCAPTCHA and header-based rules extend policies beyond raw addresses, though core ACE questions focus on IP rules, WAF, and priorities at the time of writing.

What the exam expects you to know

• Attach Cloud Armor to the Application Load Balancer backend service whenever a scenario asks for WAF, IP blocking, or geo restriction for a web application.
• Know rule priority semantics: lowest priority number is evaluated first, and the default rule at priority 2147483647 decides anything unmatched.
• Choose preconfigured WAF rules for OWASP-style attacks like SQL injection and XSS instead of writing custom expressions from scratch.
• Identify rate limiting as the Cloud Armor answer for abusive clients hammering an endpoint, distinct from load balancer capacity or autoscaling responses.
• Recognise preview mode and logging as the safe validation path before enforcing a new blocking rule in production.
• Distinguish Cloud Armor Layer 7 protection from VPC firewall rules, which operate at Layer 3 and 4 and cannot inspect HTTP request contents.

Cloud Armor vs VPC Firewall Rules: when to use which

Use Cloud Armor when filtering decisions depend on HTTP content: URLs, headers, cookies, geography, WAF attack signatures, or per-client request rates for a public web application behind a load balancer. Use VPC firewall rules when controlling network-level traffic between instances and networks by IP, port, protocol, tag, or service account, including east-west traffic that never touches a load balancer. The two are complementary layers, not substitutes. Exam scenarios naming SQL injection, XSS, or country blocking always mean Cloud Armor; scenarios naming port 22 access between VMs mean firewall rules. See also the VPC Firewall Rules notes.

Useful gcloud commands

gcloud compute security-policies create my-policy --description="Web protection policy"
gcloud compute security-policies rules create 1000 --security-policy=my-policy --action=deny-403 --src-ip-ranges=198.51.100.0/24
gcloud compute backend-services update my-backend --security-policy=my-policy --global
gcloud compute security-policies describe my-policy

Common exam traps

• Trap: Trying to attach Cloud Armor to a Network Load Balancer or directly to a VM. Cloud Armor policies attach to Application Load Balancer backend services and backend buckets in supported setups.
• Trap: Misordering rule priorities and expecting a broad allow rule written first to be overridden by a later deny; the lowest priority number wins, so deny rules need smaller numbers.
• Trap: Expecting Cloud Armor to protect non-HTTP services such as game servers or SSH. It inspects HTTP and HTTPS traffic only and is blind to other protocols.
• Trap: Enforcing new WAF rules without preview mode or sensitivity tuning, causing false positives that block legitimate users with unusual but valid request patterns.

Frequently asked questions

Where is a Cloud Armor policy applied?

A Cloud Armor security policy is attached to the backend service or backend bucket of an external Application Load Balancer. Traffic from the internet passes through the load balancer at Google's edge, where the policy's rules are evaluated in priority order before requests reach your backends. It cannot be attached directly to a VM instance or a VPC network.

How do Cloud Armor rule priorities work?

Rules are evaluated from the lowest priority number upward, and the first matching rule determines the action for that request. A default rule with the maximum priority value applies when nothing else matches, and it is commonly set to allow. This means specific deny or rate-limit rules must use lower numbers than broad allow rules to take effect.

Can Cloud Armor stop DDoS attacks?

Cloud Armor helps mitigate DDoS attacks in two ways. Google's global edge network absorbs large volumetric floods before they reach your backends, and Cloud Armor's Layer 7 rules, rate limiting, and Adaptive Protection address application-layer floods that mimic legitimate HTTP requests. It is one layer of defence and works best combined with autoscaling backends and sensible rate limits.

Study aid disclaimer: Cloud Cert Notes is an independent educational study aid. It is not affiliated with, endorsed by, or sponsored by Google, Microsoft, Amazon, Oracle, or Alibaba. Google Cloud, Associate Cloud Engineer, and Cloud Digital Leader are trademarks of Google LLC; all other certification names and product names are trademarks of their respective owners. Always confirm service details against the official provider documentation before sitting an exam.