A security operations team is designing a centralized telemetry analysis architecture in Google Cloud to investigate suspicious network events. VPC Flow Logs, Cloud Next Generation Firewall (Cloud NGFW) logs, and Cloud IDS events are aggregated into a central user-defined Cloud Logging bucket named sec-network-logs-bucket located in us-central1. The team has the following requirements: Enable SQL query capabilities on the existing log bucket using BigQuery-standard SQL without duplicating or re-ingesting raw log entries. Allow Looker Studio dashboards and BigQuery Studio to directly query the underlying log views. Configure scheduled SQL-based alerting to automatically detect anomalous traffic patterns across correlated network logs. Which sequence of actions should the security engineer take to meet these requirements?

Upgrade the log bucket using `gcloud logging buckets update sec-network-logs-bucket --location=us-central1 --enable-analytics`, create a linked dataset using `gcloud logging links create LINK_ID --bucket=sec-network-logs-bucket --location=us-central1`, and configure a SQL-based alerting policy evaluated with the BigQuery engine.: ### What Log Analytics and Linked Datasets Are **Log Analytics** enhances Google Cloud Logging buckets by enabling the execution of **BigQuery-standard SQL** queries directly over ingested log entries. By creating a **linked BigQuery dataset** using `gcloud logging links create`, Cloud Logging exposes the bucket's log views (such as `_AllLogs`) as read-only views within BigQuery without replicating, moving, or double-billing for the stored log entries. ### How It Meets the Requirements - **Zero-duplication SQL analysis:** Executing `gcloud logging buckets update ... --enable-analytics` upgrades the log bucket in place, allowing security analysts to use BigQuery-standard SQL directly against structured network telemetry. - **External BI and Looker Studio querying:** Creating a BigQuery link (`gcloud logging links create`) allows tools like **Looker Studio**, **BigQuery Studio**, and external SIEM connectors to query the log views as native BigQuery datasets. - **Scheduled SQL alerting:** With Log Analytics linked to BigQuery, engineers can define **SQL-based alerting policies** (`conditionSql`) that execute scheduled analytical queries to detect multi-event network traffic anomalies. ### Key Advantages - **Cost efficiency:** Eliminates the storage and compute costs of running separate streaming log sinks into duplicate BigQuery tables. - **Rich SQL support:** Supports advanced analytical queries, JSON manipulation, string functions (`REGEXP_EXTRACT`), and joins across log views. - **Seamless integration:** Works directly with existing Google Cloud security logging streams (VPC Flow Logs, Cloud NGFW, Cloud IDS). ### Why This Is Optimal Upgrading the existing bucket to use Log Analytics and creating a linked dataset directly addresses all operational, visualization, and alerting requirements within Google Cloud's native observability architecture.

Log Analytics Sql Network Telemetry Correlation | Professional Cloud Security Engineer

Log Analytics Sql Network Telemetry Correlation

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security operations team is designing a centralized telemetry analysis architecture in Google Cloud to investigate suspicious network events. VPC Flow Logs, Cloud Next Generation Firewall (Cloud NGFW) logs, and Cloud IDS events are aggregated into a central user-defined Cloud Logging bucket named sec-network-logs-bucket located in us-central1.

The team has the following requirements:

Enable SQL query capabilities on the existing log bucket using BigQuery-standard SQL without duplicating or re-ingesting raw log entries.
Allow Looker Studio dashboards and BigQuery Studio to directly query the underlying log views.
Configure scheduled SQL-based alerting to automatically detect anomalous traffic patterns across correlated network logs.

Which sequence of actions should the security engineer take to meet these requirements?

Create a log sink with a filter for network logs routed to a new BigQuery dataset table destination, enable BigQuery BI Engine acceleration, and create log-based metric threshold alerts in Cloud Monitoring.

Execute gcloud logging read queries within a scheduled Cloud Function, write parsed anomalies to a Cloud Storage bucket, and configure storage object notification alerts.

Upgrade the log bucket using gcloud logging buckets update sec-network-logs-bucket --location=us-central1 --enable-analytics, create a linked dataset using gcloud logging links create LINK_ID --bucket=sec-network-logs-bucket --location=us-central1, and configure a SQL-based alerting policy evaluated with the BigQuery engine.

Configure an aggregated log sink routing network logs to a Pub/Sub topic, deploy a Cloud Run subscriber to process records into BigQuery, and configure Cloud Monitoring uptime checks for alerting.

Professional Cloud Security Engineer

Log Analytics Sql Network Telemetry Correlation

Related questions