Google Professional Cloud Security Engineer Question 419
Select 2Google Cloud PlatformYour organization has deployed a multi-tier application on Google Cloud. The application is experiencing intermittent connectivity issues between the web tier and the database tier. As a Professional Cloud Security Engineer, you are tasked with identifying the root cause of the issue using network logging and monitoring tools. Which combination of actions should you take to effectively troubleshoot the problem while ensuring minimal performance impact?
- A
Enable VPC Flow Logs on the subnet where the database resides to capture information about network traffic.
- B
Use Packet Mirroring to analyze the full packet payloads of traffic between the web and database tiers.
- C
Deploy Cloud IDS to detect and analyze potential malicious traffic affecting the database.
- D
Use Log Analytics in Cloud Logging to query and analyze VPC Flow Logs for unusual patterns.
- E
Enable Cloud Next Generation Firewall (Cloud NGFW) logging to monitor allowed and denied traffic across the network.
Show answer and explanation
Correct answers: A, D
Explanation
To troubleshoot intermittent connectivity issues between the web and database tiers, enabling VPC Flow Logs is a lightweight method to gather critical metadata about network traffic. This data can then be analyzed using Log Analytics in Cloud Logging to identify unusual patterns or dropped connections. Packet Mirroring and Cloud IDS are more resource-intensive and are better suited for other use cases, such as deep packet inspection or detecting malicious traffic. Cloud NGFW logging is focused on firewall rule monitoring and is not the most effective tool for diagnosing connectivity issues in this scenario.
- A. Correct.
Enabling VPC Flow Logs provides metadata about network traffic, such as source and destination IPs, ports, and protocols, which is critical for identifying connectivity issues. It has minimal performance impact since it only collects metadata.
- B. Incorrect.
Packet Mirroring captures full packet payloads, which is resource-intensive and may significantly impact network performance. This is not the best first step for troubleshooting intermittent connectivity issues.
- C. Incorrect.
Cloud IDS is designed to detect and analyze malicious traffic. While useful for security purposes, it is not specifically tailored for troubleshooting general connectivity issues.
- D. Correct.
Using Log Analytics to query and analyze VPC Flow Logs is an effective way to identify unusual traffic patterns or dropped connections. This tool is designed for deep analysis without impacting performance.
- E. Incorrect.
Cloud NGFW logging is primarily used for monitoring firewall rules and security-related traffic patterns. While it can provide insights, it is not as focused on the root cause analysis of connectivity issues between tiers.