Cloud Digital Leader Google Cloud Security Practice Question
A company wants to detect and prioritize vulnerabilities in their Compute Engine VMs and GKE clusters. They also need a centralized view of security findings across their organization. Which service should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security Command Center
Security Command Center (SCC) is the central vulnerability and threat detection service for GCP. It finds misconfigurations, vulnerabilities, and threats across services like Compute Engine and GKE, and provides a dashboard for prioritization. Chronicle is a SIEM for log analysis, not vulnerability scanning. Cloud IDS is for network intrusion detection. Web Risk API is for checking URLs against threat lists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud IDS
Why it's wrong here
Cloud IDS is a network-based intrusion detection service that inspects traffic between VMs and the internet for known threats like malware signatures and exploit kits. It does not perform agent-based or API-driven scans of VM instances or container images, so it cannot enumerate CVEs, misconfigured packages, or exposed ports. Its purpose is detecting active network attacks, not assessing the vulnerability posture of cloud resources.
- ✗
Web Risk API
Why it's wrong here
Web Risk API is a lookup service that checks URLs and hashes against Google's constantly updated lists of dangerous web pages, such as phishing sites and sources of malware. It is designed for protecting end users who click links in applications or browsers, not for scanning cloud infrastructure. It has no visibility into a VM's OS, installed software, or container image layers, and therefore cannot identify exploitable vulnerabilities in compute resources.
- ✓
Security Command Center
Why this is correct
Security Command Center (SCC) is Google Cloud's centralized security and risk management platform, and it provides built-in vulnerability scanning for Compute Engine VMs and GKE container images. It aggregates findings from native Google Cloud services and partner security tools into a single view, then uses severity scores, exposure data, and attack path simulation to help security teams prioritize which vulnerabilities to remediate first. This directly matches the requirement to detect and prioritize vulnerabilities across a cloud environment.
- ✗
Chronicle
Why it's wrong here
Chronicle is Google Cloud's security analytics and SIEM solution, which ingests logs and telemetry after events have occurred to support search, investigation, and detection of threats via rules and machine learning. It does not actively scan systems for vulnerabilities; instead, it relies on the data that other services collect. Without a complementary scanner, Chronicle cannot discover a CVE in a VM or a weakness in a container image, so it is not a vulnerability assessment tool.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Compute Engine
Compute Engine is Google Cloud's Infrastructure-as-a-Service (IaaS) offering that lets you create and run virtual machines on Google's infrastructure.
Key term
Security Command Center
Security Command Center is a centralized cloud security management platform that helps organizations detect, investigate, and respond to threats across their cloud infrastructure.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.