Google Professional-Cloud-Architect Exam With Confidence Using Practice Dumps

According to the Apigee API Platform documentation, the Quota policy is the primary mechanism used to enforce business-level constraints by limiting the number of request messages an API proxy allows over a specific period of time (such as a minute, hour, day, week, or month). For a media company like Altostrat, which aims to "unlock new revenue streams through targeted marketing" and "drive revenue growth," managing API consumption is critical for cost predictability and monetization strategies.

Google Cloud distinguishes between Spike Arrest and Quota policies. While Spike Arrest is designed for operational safety—protecting backend systems from sudden traffic bursts—the Quota policy is specifically used to enforce business contracts, Service Level Agreements (SLAs), and cost management. By configuring a Quota policy, Altostrat can ensure that no single consumer or application exceeds the total volume of calls that would result in unexpected infrastructure costs or exceed the limits of their current subscription tier.

Options A and B (API Key and OAuth) are essential for authentication and authorization—identifying who is making the call—but they do not inherently limit the volume of calls. Option D (XML threat protection) is a security measure to prevent malformed payload attacks. Therefore, to meet the specific business requirement of "Reliability and cost management," implementing Quota policies within Apigee is the architecturally correct choice to prevent API abuse and manage operational expenditure.

According to the Google Cloud Architecture Framework and Google Cloud Armor documentation, Google Cloud Armor is the enterprise-grade solution for protecting applications and services against Distributed Denial of Service (DDoS) attacks and web-based exploits. Altostrat requires a solution that addresses "multi-vector" attacks at "various layers," specifically the Network/Transport layers (L3/L4) and the Application layer (L7).

Google Cloud Armor provides built-in, always-on protection against L3 and L4 volumetric attacks at the edge of Google’s network, preventing malicious traffic from reaching the backend GKE clusters or Cloud Run functions. For L7 (Application Layer) protection, Cloud Armor offers Web Application Firewall (WAF) capabilities, including pre-configured rule sets (based on OWASP Top 10), rate limiting, and Adaptive Protection. The latter uses machine learning to detect anomalies in traffic patterns specific to Altostrat’s applications, automatically suggesting rules to block sophisticated botnets or application-layer floods.

While Cloud NGFW (Option B) provides essential network filtering, it lacks the native L7 inspection and global DDoS scrubbing capabilities inherent to Cloud Armor. VPC Service Controls (Option A) focus on data exfiltration and API security perimeters, and Security Command Center (Option D) is a posture management and threat detection tool rather than an active traffic mitigation service. Deploying Cloud Armor at the global load balancing tier ensures Altostrat maintains the high availability and reliability required for its global media streaming audience.