Google Professional Cloud Security Engineer Question 422
Select 2Google Cloud PlatformYour organization wants to enhance its network security by identifying unusual traffic patterns and detecting potential intrusions in real time. They want to capture detailed logs of network traffic at the VPC level and also implement a solution to detect malicious activity using signatures and threat intelligence. Which combination of Google Cloud tools should you configure to achieve this goal?
- A
Enable VPC Flow Logs and analyze them in Log Analytics.
- B
Set up Packet Mirroring to capture all traffic and send it to a third-party analysis tool.
- C
Deploy Cloud Intrusion Detection System (Cloud IDS) for detecting malicious traffic and threats.
- D
Configure Cloud Next Generation Firewall (Cloud NGFW) for advanced traffic filtering and logging.
- E
Use Cloud NAT for translating outbound traffic to public IP addresses.
Show answer and explanation
Correct answers: A, C
Explanation
To enhance network security and identify unusual traffic patterns, VPC Flow Logs provide essential metadata for analysis, and Cloud IDS offers real-time intrusion detection and threat intelligence. These two tools together provide a comprehensive solution for monitoring and securing network traffic.
- A. Correct.
VPC Flow Logs capture network traffic metadata at the VPC level, which can be analyzed in Log Analytics to identify traffic patterns and troubleshoot issues. This is foundational for network monitoring and security.
- B. Incorrect.
Packet Mirroring allows detailed capture of packets for analysis, but it is more resource-intensive and typically used for specific scenarios like forensic investigations. It is not the most efficient way to achieve the goal in this scenario.
- C. Correct.
Cloud IDS uses signature-based detection and threat intelligence to identify malicious traffic. It is specifically designed to detect intrusions and complements VPC Flow Logs for network security.
- D. Incorrect.
Cloud NGFW focuses on advanced traffic filtering and can log traffic, but it is not specifically designed for intrusion detection or network traffic analysis.
- E. Incorrect.
Cloud NAT is used for managing outbound traffic and translating private IPs to public IPs, but it does not provide any intrusion detection or traffic analysis capabilities.