An enterprise has deployed Google Cloud Secure Web Proxy (SWP) to govern and inspect all outbound egress internet traffic from its Compute Engine and Google Kubernetes Engine (GKE) workloads. The Security Operations Center (SOC) team establishes the following operational and security requirements: Monitor proxy operational health, traffic volume, and policy violation events in real time with automated alerting. Export and normalize all proxy access logs into Chronicle SecOps (SIEM) for multi-year retention and behavioral analysis. Correlate outbound web traffic continuously against updated threat intelligence feeds to identify interactions with command-and-control (C2) domains and malicious IPs. Which architectural solution should the security team implement to meet these requirements?

Configure Cloud Logging sinks to route proxy transaction and security logs to Chronicle SecOps for Universal Data Model (UDM) normalization; set up Cloud Monitoring metrics and log-based alert policies for policy drops and proxy health; and leverage Chronicle SecOps threat intelligence integration with Mandiant and VirusTotal to automatically correlate outbound proxy events against malicious domains and IPs.: ### What the Solution Is This architecture combines native **Google Cloud Observability** services (**Cloud Logging** and **Cloud Monitoring**) with **Chronicle SecOps (SIEM/SOAR)** to deliver end-to-end visibility, automated alerting, and intelligence-driven threat detection for Secure Web Proxy egress infrastructure. ### How It Meets the Requirements - **Real-time Monitoring & Alerting**: Cloud Monitoring tracks proxy infrastructure metrics (such as connection rates, latency, and error counts) while Cloud Logging uses log-based metrics and alerting policies to trigger notifications whenever proxy security policies deny unauthorized egress requests. - **SIEM Export & Normalization**: Cloud Logging sinks stream proxy access logs into Chronicle SecOps using dedicated ingestion collectors or webhooks. Chronicle automatically parses and normalizes proxy transactions into the **Universal Data Model (UDM)**, enabling structured indexing, fast searching, and compliance retention. - **Threat Intelligence Correlation**: Chronicle SecOps natively links normalized proxy traffic against continuous threat intelligence feeds, including **Mandiant** and **VirusTotal**, instantly flagging outbound connections to known malicious domains, IPs, and command-and-control infrastructure. ### Key Advantages and Capabilities - **Unified Data Model (UDM)**: Harmonizes disparate web proxy telemetry with network flow logs, endpoint logs, and identity context for rapid investigation. - **Integrated Threat Feeds**: Eliminates manual maintenance of domain blocklists by dynamically matching outbound URLs and IPs with curated threat intelligence. - **Automated Incident Response**: Chronicle SOAR playbooks can ingest high-fidelity alerts to automatically update Secure Web Proxy URL lists or isolate compromised instances. - **Native Cloud Integration**: Avoids deploying compute-heavy log forwarding agents inside workloads by utilizing managed Cloud Logging export pipelines. ### Why This Is Optimal Leveraging native Cloud Logging sinks directly to Chronicle SecOps provides seamless log pipeline scalability, out-of-the-box UDM parsing for web proxy events, and automated correlation against Google Cloud, Mandiant, and VirusTotal threat data without requiring third-party log infrastructure.

Secure Web Proxy Logging Chronicle Threat Intel | Professional Cloud Security Engineer

Secure Web Proxy Logging Chronicle Threat Intel

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise has deployed Google Cloud Secure Web Proxy (SWP) to govern and inspect all outbound egress internet traffic from its Compute Engine and Google Kubernetes Engine (GKE) workloads. The Security Operations Center (SOC) team establishes the following operational and security requirements:

Monitor proxy operational health, traffic volume, and policy violation events in real time with automated alerting.
Export and normalize all proxy access logs into Chronicle SecOps (SIEM) for multi-year retention and behavioral analysis.
Correlate outbound web traffic continuously against updated threat intelligence feeds to identify interactions with command-and-control (C2) domains and malicious IPs.

Which architectural solution should the security team implement to meet these requirements?

Enable Cloud Audit Logs for Admin Activity only; route these logs through Cloud Trace to Event Threat Detection; and configure manual webhook triggers to push alerts to an on-premises ticketing platform.

Configure Cloud Logging sinks to route proxy transaction and security logs to Chronicle SecOps for Universal Data Model (UDM) normalization; set up Cloud Monitoring metrics and log-based alert policies for policy drops and proxy health; and leverage Chronicle SecOps threat intelligence integration with Mandiant and VirusTotal to automatically correlate outbound proxy events against malicious domains and IPs.

Rely exclusively on VPC Flow Logs exported to BigQuery; create scheduled SQL queries to match destination IPs against public threat lists; and configure Cloud Monitoring uptime checks against the internal IP of the Secure Web Proxy.

Configure Packet Mirroring on the Secure Web Proxy gateway subnet to mirror traffic to an array of third-party intrusion detection virtual machines; execute cron jobs on the VMs to download open-source threat lists; and send local syslog data directly to Cloud Storage buckets.

Professional Cloud Security Engineer

Secure Web Proxy Logging Chronicle Threat Intel

Related questions