GCP Professional Cloud Security Engineer Practice Question

Your organization operates three GKE clusters in separate projects, all attached to the same VPC network. Only workloads in the production subnet 10.20.0.0/16 located in europe-west1 must be inspected for command-and-control traffic, and the security team wants to query detections with SQL in near real time. You have been asked to design this solution while avoiding any self-managed network-inspection appliances. Which approach should you recommend?

Deploy a fleet of third-party intrusion-detection virtual appliances in a shared VPC service project, mirror all VPC traffic to them, and export VPC Flow Logs to BigQuery for later analysis.
Install an open-source IDS DaemonSet on each GKE cluster for inline inspection and use Pub/Sub with Cloud Functions to batch-export the resulting logs to Cloud Storage for monthly review.
In each project, deploy a Cloud IDS endpoint in europe-west1, configure a Packet Mirroring policy that selects traffic with source subnet 10.20.0.0/16, and create a centralized Log Router sink that streams "networksecurity.googleapis.com/firewall_threat" logs from Cloud Logging to a BigQuery dataset for analysis.
Create a single Cloud IDS endpoint in us-central1, peer each project's VPC to a dedicated security VPC in that region, mirror all VPC traffic to the IDS endpoint, and export only Cloud Audit Logs to BigQuery.

Report Issue

Answer Description

Cloud IDS is Google Cloud's managed network-intrusion detection service. It analyzes traffic copies received from VPC Packet Mirroring and writes its threat detections to Cloud Logging with the log ID "networksecurity.googleapis.com/firewall_threat" (resource type "network_security"). Deploying a dedicated Cloud IDS endpoint in europe-west1 and creating a Packet Mirroring policy that selects only the 10.20.0.0/16 production subnet ensures the required traffic is inspected without introducing self-managed appliances. A centralized log sink can then export the Cloud IDS threat logs to a BigQuery dataset (via Log Router → BigQuery) or to a Log Analytics bucket backed by BigQuery, enabling near real-time SQL analysis. The other options either rely on third-party appliances, inspect traffic in the wrong region, fail to restrict mirroring to the production subnet, or export the wrong log types, so they do not meet the stated constraints.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.