A global external application load balancer fronts a public-facing app. To protect against application-layer attacks, what should you do?

The correct option is to create a Google Cloud Armor security policy with WAF rules and attach it to the backend service. Google Cloud Armor is a DDoS protection and WAF (Web Application Firewall) service designed to protect applications and services running on Google Cloud from various web-based attacks, including application-layer attacks like SQL injection and cross-site scripting. Attaching a security policy with WAF rules to the backend service of a global external application load balancer enables this protection. Enabling Cloud CDN primarily caches content to improve performance and reduce origin load; it does not inherently protect against application-layer attacks. Creating multiple firewall deny rules at the load balancer level is not the most effective or scalable solution for application-layer attacks, which require deeper inspection than typical firewall rules provide. VPC Service Controls create security perimeters to prevent data exfiltration and are not designed for protecting against application-layer attacks.