A security operations team is investigating suspicious lateral movement within a Google Cloud VPC. The incident response policy requires capturing and analyzing raw packet payloads (Layer 3 through Layer 7)—including full application data—from specific production Compute Engine instances hosting sensitive database workloads. The capture architecture must meet the following requirements: Inspect complete raw packet data out-of-band without inline latency or disruption to production workloads. Support high availability and load distribution across a cluster of backend network intrusion detection system (NIDS) collector instances. Which solution should the team implement?

Configure a Packet Mirroring policy targeting the production instances or subnets, and set the collector destination to an internal passthrough Network Load Balancer forwarding rule configured with the packet mirroring collector option.: ### What Packet Mirroring and Internal Collector Load Balancers Are **Google Cloud Packet Mirroring** clones full Layer 3 through Layer 7 network traffic (both ingress and egress) directly from the virtual machine's virtual network interface (vNIC) at the Andromeda virtualization layer. It sends an exact copy of the traffic out-of-band to an **internal passthrough Network Load Balancer** without modifying, slowing down, or terminating the production packet stream. ### How It Meets the Requirements - **Complete Raw Packet Payloads:** Unlike telemetry logs, **Packet Mirroring captures raw payload bytes**, including packet headers and application data, satisfying deep forensic and NIDS requirements. - **Out-of-Band Inspection:** The packet cloning happens inside the hypervisor network stack. Because it is completely **out-of-band**, inspection failures or collector latency do not impact production application performance or throughput. - **High Availability & Load Distribution:** The traffic is forwarded directly to the forwarding rule of an **internal passthrough Network Load Balancer** configured with `--is-mirroring-collector`. The load balancer distributes the mirrored traffic across an autoscaled backend instance group of collector appliances. ### Key Capabilities - **Granular Filtering:** Allows filtering mirrored traffic by IPv4/IPv6 CIDR ranges, IP protocols (TCP, UDP, ICMP), and traffic direction (ingress, egress, or both). - **Zero Inline Overhead:** Virtual appliances receive cloned traffic without sitting directly in the routing path or acting as the default gateway. - **Symmetric Flow Hashing:** Directs bidirectional flows to the same collector instance when symmetric hashing is enabled. - **Shared VPC & Cross-VPC Peering:** Collectors can reside in a central security VPC and inspect mirrored workloads in spoke application VPCs. ### Why This Is Optimal This architecture provides enterprise-grade, native network packet capture. It completely decouples security monitoring from production traffic flow, ensuring forensic-level packet visibility with automatic failover and scalability.

Configure Packet Mirroring Internal Load Balancer Inspection | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

An enterprise has enabled Cloud Next Generation Firewall (Cloud NGFW) Enterprise with Intrusion Detection and Prevention Service (IDPS) in a global network firewall policy. A security engineer is investigating a potential command-and-control communication attempt targeting an internal Compute Engine workload. The engineer needs to query Cloud Logging to locate the Layer 7 threat detection record generated by the firewall endpoint and correlate it with the firewall policy rule execution. Which query strategy and log structure should the security engineer use in Cloud Logging to analyze both events?

Configuring and analyzing network logs (Cloud Next Generation Firewall [Cloud NGFW], VPC flow logs, Packet Mirroring, Cloud Intrusion Detection System [Cloud IDS], Log Analytics).

AdvancedProfessional Cloud Security Engineer

A security operations team is designing a centralized telemetry analysis architecture in Google Cloud to investigate suspicious network events. VPC Flow Logs, Cloud Next Generation Firewall (Cloud NGFW) logs, and Cloud IDS events are aggregated into a central user-defined Cloud Logging bucket named sec-network-logs-bucket located in us-central1. The team has the following requirements: Enable SQL query capabilities on the existing log bucket using BigQuery-standard SQL without duplicating or re-ingesting raw log entries. Allow Looker Studio dashboards and BigQuery Studio to directly query the underlying log views. Configure scheduled SQL-based alerting to automatically detect anomalous traffic patterns across correlated network logs. Which sequence of actions should the security engineer take to meet these requirements?

AdvancedProfessional Cloud Security Engineer

An enterprise security team wants to harden their Google Cloud environment by eliminating long-lived, user-managed service account keys. The team must enforce guardrails across the entire resource hierarchy to prevent developers from creating new service account keys or uploading external public keys. In addition, an external application running outside Google Cloud must be able to securely authenticate and access Google Cloud resources using short-lived credentials rather than static key files. Which set of actions should the security team implement?

AdvancedProfessional Cloud Security Engineer

An enterprise is designing a Cardholder Data Environment (CDE) on Google Cloud to meet stringent PCI-DSS and FedRAMP network segmentation and perimeter defense mandates. The architecture deploys a Shared VPC host project for centralized network management alongside multiple service projects hosting compute workloads, Cloud Build private pools, and Cloud Storage buckets containing sensitive cardholder data. Which architectural requirement must be implemented to enforce the VPC Service Controls boundary across this infrastructure without breaking communication?

AdvancedProfessional Cloud Security Engineer

A security engineer is configuring and troubleshooting context-aware access controls for administrative access to resources protected inside a VPC Service Controls perimeter. The engineer has created Access Context Manager access levels that enforce device posture verification and IP origin restrictions. Different access bindings were applied to multiple Google Groups in Cloud Identity to govern various developer tiers. During security validation, the engineer discovers that a user assigned to both the Security-Core group (which enforces a strict managed device posture) and the General-Auditors group (which only requires a corporate network IP) can successfully invoke Google Cloud APIs on perimeter-protected resources from an unapproved personal device. Why is this access permitted, and how should the security engineer remediate the issue?

AdvancedProfessional Cloud Data Engineer

An enterprise data engineering team is designing a cost-optimized storage architecture on Cloud Storage for large-scale analytical training datasets and compliance logs. The data lifecycle and operational requirements are as follows: Ingestion & Active Processing (Days 1–30): Newly ingested datasets are actively read, transformed, and queried multiple times per day by data pipelines. Periodic Validation (Days 31–90): Datasets are accessed at most once per month for model validation and intermittent quarterly reporting. Long-term Compliance (Day 91 to 7 Years): Data must be retained for regulatory compliance for seven years, accessed less than once a year, but any ad-hoc audit queries require sub-second (millisecond) retrieval latency. Cost Governance: The strategy must minimize total storage costs while strictly avoiding early deletion fees and premature class transition penalties. Which Object Lifecycle Management policy should the team configure to meet these requirements?

Professional Cloud Security Engineer

Configure Packet Mirroring Internal Load Balancer Inspection

Related questions