An enterprise has enabled Cloud Next Generation Firewall (Cloud NGFW) Enterprise with Intrusion Detection and Prevention Service (IDPS) in a global network firewall policy. A security engineer is investigating a potential command-and-control communication attempt targeting an internal Compute Engine workload. The engineer needs to query Cloud Logging to locate the Layer 7 threat detection record generated by the firewall endpoint and correlate it with the firewall policy rule execution. Which query strategy and log structure should the security engineer use in Cloud Logging to analyze both events?

Query the resource type networksecurity.googleapis.com/FirewallEndpoint for logName networksecurity.googleapis.com/firewall_threat to inspect threat details, and correlate with firewall logs where jsonPayload.rule_details.action is set to APPLY_SECURITY_PROFILE_GROUP.: ### What Cloud NGFW Threat Logging and Firewall Rule Logging Is **Cloud Next Generation Firewall (Cloud NGFW) Enterprise** provides advanced Layer 7 inspection powered by intrusion detection and prevention technologies. When traffic matches a firewall policy rule configured with the `apply_security_profile_group` action, Cloud NGFW evaluates the packet against defined threat prevention security profiles. Cloud NGFW generates distinct log streams in **Cloud Logging**: one for the initial firewall policy rule match and another for the deep packet Layer 7 inspection performed by the **firewall endpoint**. ### How It Meets the Investigation Requirements - **Threat Log Identification**: When a malicious pattern or signature (such as a command-and-control connection) is identified, the firewall endpoint emits a log record under the resource type `networksecurity.googleapis.com/FirewallEndpoint` and log name `networksecurity.googleapis.com/firewall_threat`. This record contains the `threatDetails` payload with critical telemetry including **threat ID**, **severity**, **CVE references**, and the applied action. - **Firewall Rule Correlation**: When logging is enabled on the firewall policy rule, Cloud NGFW logs an initial **Firewall Rules Logging** entry where `jsonPayload.rule_details.action` is logged as `APPLY_SECURITY_PROFILE_GROUP`. The engineer can cross-reference the connection 5-tuple (source IP, source port, destination IP, destination port, and protocol) between the firewall rule log and the threat log to pinpoint the exact connection and policy rule. ### Key Advantages and Capabilities - **Granular Threat Telemetry**: Threat logs include specific fields such as `category`, `threat_id`, `alert_severity`, and `direction` (`CLIENT_TO_SERVER` or `SERVER_TO_CLIENT`). - **Stateful Connection Tracking**: Correlates L3/L4 connection 5-tuples with L7 deep inspection findings. - **Centralized Log Analytics**: Enables security analysts to run SQL queries in Log Analytics or set up real-time alerting on high-severity network intrusions. - **Action Visibility**: Reports whether the firewall endpoint took the default action, dropped packets (`DROP`), or generated alerts (`ALERT`). ### Why This Is Optimal Querying the dedicated `networksecurity.googleapis.com/firewall_threat` log name combined with the `APPLY_SECURITY_PROFILE_GROUP` rule disposition is the only native mechanism in Google Cloud to perform end-to-end correlation between network firewall enforcement and Layer 7 intrusion signatures.

Cloud Ngfw Threat Log Correlation Cloud Logging | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

A security operations team is investigating suspicious lateral movement within a Google Cloud VPC. The incident response policy requires capturing and analyzing raw packet payloads (Layer 3 through Layer 7)—including full application data—from specific production Compute Engine instances hosting sensitive database workloads. The capture architecture must meet the following requirements: Inspect complete raw packet data out-of-band without inline latency or disruption to production workloads. Support high availability and load distribution across a cluster of backend network intrusion detection system (NIDS) collector instances. Which solution should the team implement?

Configuring and analyzing network logs (Cloud Next Generation Firewall [Cloud NGFW], VPC flow logs, Packet Mirroring, Cloud Intrusion Detection System [Cloud IDS], Log Analytics).

AdvancedProfessional Cloud Security Engineer

A security operations team is designing a centralized telemetry analysis architecture in Google Cloud to investigate suspicious network events. VPC Flow Logs, Cloud Next Generation Firewall (Cloud NGFW) logs, and Cloud IDS events are aggregated into a central user-defined Cloud Logging bucket named sec-network-logs-bucket located in us-central1. The team has the following requirements: Enable SQL query capabilities on the existing log bucket using BigQuery-standard SQL without duplicating or re-ingesting raw log entries. Allow Looker Studio dashboards and BigQuery Studio to directly query the underlying log views. Configure scheduled SQL-based alerting to automatically detect anomalous traffic patterns across correlated network logs. Which sequence of actions should the security engineer take to meet these requirements?

AdvancedProfessional Cloud Security Engineer

An enterprise organization is establishing perimeter security and API governance across its Google Cloud resource hierarchy. A security engineer must implement controls to meet the following requirements: Requirement 1: Prevent project owners in the Development folder from activating or consuming any unapproved Google Cloud APIs, ensuring only an explicit allowlist of authorized services (such as Compute Engine and Cloud Storage) can be used. Requirement 2: Secure external API keys used by backend web servers so that the keys can only be used from authorized server IP addresses and can only invoke the designated backend service API. Which combination of controls should the security engineer implement to satisfy these requirements?

AdvancedProfessional Cloud Security Engineer

An enterprise maintains two distinct regular VPC Service Controls perimeters: Perimeter-A for core internal workloads and Perimeter-B for departmental data storage. A centralized processing workload in a project within Perimeter-A requires bidirectional API communication and data exchange with Cloud Storage buckets located in a project protected by Perimeter-B. The organization's governance rules prohibit merging the perimeters or modifying the projects assigned to each perimeter boundary. Which solution should the security engineer implement to enable communication between the two projects?

AdvancedProfessional Cloud Security Engineer

An enterprise organization is structuring access for its engineering teams across distinct application environments organized into Development, Testing, and Production folders in Google Cloud. The organization has the following access and operational requirements: Multiple product squads (such as Squad Alpha and Squad Beta) require granular administrative permissions on their squad-specific resources within the Development folder. All developers across all squads must automatically inherit broad read-only and monitoring permissions across all non-production environment folders. Elevated write access to the Production folder must be restricted strictly to squad leads. User onboarding and offboarding must be managed with minimal administrative overhead, avoiding direct IAM policy updates on Google Cloud resource nodes while preserving clear audit trails. Which Cloud Identity group hierarchy and IAM binding design should the security engineer implement?

AdvancedProfessional Cloud DevOps Engineer

Your enterprise is designing a secure Continuous Integration (CI) pipeline using Cloud Build triggered from a Secure Source Manager repository. The pipeline must fetch application dependencies, retrieve sensitive API keys from Secret Manager, build container images, push them to Artifact Registry, and create attestations for Binary Authorization. To enforce security compliance, your team must adhere strictly to the principle of least privilege for all service identities involved in build invocation and execution. Which IAM role and identity configuration should you implement?

Professional Cloud Security Engineer

Cloud Ngfw Threat Log Correlation Cloud Logging

Related questions