Cloud Ids Threat Inspection Tuning Capacity

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is designing an application-layer intrusion detection strategy for a mission-critical financial processing workload running across multiple zones in a single Google Cloud region. The workload experiences a sustained traffic volume of 12 Gbps, requires deep Layer 7 inspection of both ingress/egress and east-west intra-subnet lateral communications for malware and command-and-control activity, and must identify applications regardless of the ports used.

During testing, specific benign internal maintenance tasks triggered false-positive alerts against standard intrusion signatures.

Which configuration should the security engineer deploy to inspect this application traffic and tune the detection profile?

Deploy Google Cloud Armor security policies with preconfigured WAF rules attached to an internal TCP/UDP load balancer, and apply Layer 7 rate-limiting rules across all backend instances.

Provision a single Cloud IDS endpoint in the region relying on anomalous burst capacity to process the 12 Gbps sustained throughput, attach an ingress-only Packet Mirroring policy, and disable the default signature set in the profile.

Establish Private Services Access with Google-managed services, provision three Cloud IDS endpoints in the region, attach Packet Mirroring policies covering the workload subnets, and configure threat exceptions for the specific false-positive signature IDs.

Configure VPC Network Peering to an external transit VPC, enable VPC Flow Logs with extended metadata sampling, and apply Layer 4 Cloud NGFW firewall rules with logging enabled.

Professional Cloud Security Engineer

Cloud Ids Threat Inspection Tuning Capacity

Related questions