Google Professional Cloud Security Engineer Question 423
Select 2Google Cloud PlatformYour organization has deployed a multi-tier application in Google Cloud, and you are tasked with configuring network monitoring to detect and analyze suspicious traffic patterns across the Virtual Private Cloud (VPC). The requirements are as follows:
- Monitor traffic at the packet level for an investigation related to potential breaches.
- Analyze flow-level metadata to identify anomalous patterns in network traffic.
- Implement intrusion detection to identify malicious activities in real time.
Which combination of Google Cloud tools should you use to meet these requirements?
- A
Packet Mirroring for packet-level monitoring, VPC Flow Logs for flow-level metadata, and Cloud IDS for intrusion detection
- B
Only VPC Flow Logs for both packet-level monitoring and flow-level metadata
- C
Cloud IDS for packet-level monitoring and VPC Flow Logs for flow-level metadata
- D
Packet Mirroring for packet-level monitoring and Cloud IDS for intrusion detection
- E
Cloud Next Generation Firewall (Cloud NGFW) for packet-level monitoring and VPC Flow Logs for flow-level metadata
Show answer and explanation
Correct answers: A, D
Explanation
To meet the requirements, you need a combination of tools. Packet Mirroring is ideal for packet-level monitoring by capturing and copying network packets for analysis. VPC Flow Logs provide flow-level metadata, which can help identify anomalous traffic patterns. Finally, Cloud IDS is designed for real-time detection of malicious activities. The first option combines all three tools to fully satisfy the requirements. The fourth option partially satisfies the requirements but lacks flow-level metadata monitoring.
- A. Correct.
Correct. Packet Mirroring allows you to monitor traffic at the packet level by copying packets at the subnet level, VPC Flow Logs provide flow-level metadata, and Cloud IDS detects malicious activities in real time.
- B. Incorrect.
Incorrect. VPC Flow Logs only provide flow-level metadata and do not monitor traffic at the packet level. This cannot fulfill all the requirements.
- C. Incorrect.
Incorrect. Cloud IDS does not offer packet-level monitoring; it is designed for intrusion detection. VPC Flow Logs only provide flow-level metadata.
- D. Correct.
Correct. Packet Mirroring allows for detailed packet-level monitoring, while Cloud IDS provides real-time intrusion detection. However, this option does not cover flow-level metadata monitoring.
- E. Incorrect.
Incorrect. Cloud NGFW does not provide packet-level monitoring; it is primarily used for enforcing firewall rules. VPC Flow Logs, while useful for flow-level metadata, do not cover the other requirements.