GCP Professional Cloud Security Engineer Practice Question

Your security team must detect command-and-control (C2) activity originating from Compute Engine VMs in a production VPC and have every Cloud IDS finding available for near-real-time SQL analysis in the organization's centralized "sec-logs" project, which already contains a Log Analytics-enabled log bucket. You want a solution that reuses managed Google Cloud features and minimizes custom code and ongoing maintenance. What should you do?

Create a regional Packet Mirroring policy that mirrors all VM egress traffic to a new Cloud IDS endpoint in the same region, then configure an organization-level aggregated log sink that filters on the Cloud IDS threat log and routes it to the existing "sec-logs" log bucket.
Enable VPC Flow Logs at sampling rate 1.0, export the logs to Pub/Sub, and deploy a Dataflow pipeline that parses the logs and writes C2 events to BigQuery in the "sec-logs" project.
Deploy third-party IDS sensors on a dedicated GKE cluster, forward mirrored traffic to the sensors, and use a custom Fluentd daemonset to push alerts to the "sec-logs" bucket.
Turn on Cloud NGFW in Enterprise tier with threat prevention, then configure Cloud Monitoring alerting policies to copy all firewall threat logs into the "sec-logs" project via Pub/Sub.

Report Issue

Answer Description

Cloud IDS requires a Packet Mirroring policy to receive a copy of the VPC's traffic. When Cloud IDS analyzes that mirrored traffic it generates threat findings that are written automatically to Cloud Logging in the same project and region where the IDS endpoint resides, using the log type ids.googleapis.com/threat. An aggregated sink created at the organization (or folder) level can match this log with a filter such as log_id("ids_threat") and route every matching entry, in near real time, to the existing log bucket in the centralized security project. Because aggregated sinks are managed by Cloud Logging, no custom code, additional services, or third-party collectors are required, and the data becomes immediately queryable with Log Analytics in BigQuery SQL. The other options either miss Cloud IDS entirely, rely on VPC Flow Logs (which do not detect application-layer C2 patterns), or introduce unnecessary custom pipelines and maintenance overhead.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.