Google Professional Cloud Security Engineer Question 420
Select 4Google Cloud PlatformYour organization recently deployed a sensitive application in Google Cloud. To proactively monitor potential intrusions and analyze suspicious traffic patterns, you are tasked with configuring network logs and threat detection mechanisms. Which combination of tools would you use to achieve this, ensuring high visibility into both network traffic and potential intrusion attempts?
- A
Enable VPC Flow Logs to capture network traffic metadata within the VPC.
- B
Set up Cloud IDS to detect and alert on potential intrusions in near real-time.
- C
Use Packet Mirroring to capture full network traffic packets for in-depth analysis.
- D
Activate Cloud NAT to log outbound internet traffic for all instances.
- E
Enable Cloud Next Generation Firewall (Cloud NGFW) logging to analyze allowed and denied traffic.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To effectively monitor and analyze network traffic while detecting potential intrusions, you need a combination of tools. VPC Flow Logs provide metadata for general traffic analysis, Packet Mirroring captures entire packets for detailed examination, and Cloud IDS detects intrusions in near real-time. Additionally, Cloud NGFW logs provide insights into traffic allowed or denied by firewall rules, helping identify misconfigurations or unauthorized access attempts. Cloud NAT, while useful for managing internet connectivity, does not directly address the scenario's requirements for detailed analysis and intrusion detection.
- A. Correct.
VPC Flow Logs provide metadata about network traffic, such as source and destination IP, port, protocol, and bytes transmitted, which is crucial for monitoring and analysis.
- B. Correct.
Cloud IDS is a managed intrusion detection system that detects potential threats and generates alerts based on predefined threat signatures, offering real-time protection.
- C. Correct.
Packet Mirroring allows you to capture full packet data for selected workloads, enabling in-depth traffic analysis or troubleshooting.
- D. Incorrect.
Cloud NAT is primarily used for managing outbound internet connectivity for instances without public IPs. While it can generate logs, it does not provide the detailed network monitoring or intrusion detection required by the scenario.
- E. Correct.
Cloud NGFW logging enables you to track allowed and denied traffic through firewall rules, allowing you to analyze potential threats and misconfigurations.