Cloud Digital Leader Google Cloud Security Practice Question
A security engineer needs to analyze network traffic for malicious payloads and anomalies in real-time across multiple VPC networks in a project. The solution must be managed and not require deploying third-party appliances. Which service should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud IDS
Cloud IDS provides managed intrusion detection across VPC networks, analyzing traffic for threats like malware and anomalies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security Command Center
Why it's wrong here
Security Command Center is Google Cloud's security and risk management platform that aggregates findings, maintains an asset inventory, and identifies misconfigurations and vulnerabilities. However, it does not perform real-time deep packet inspection on network traffic; instead it relies on data from other services like Cloud IDS or VPC Flow Logs to surface findings. It is not a substitute for analyzing the actual traffic payloads.
- ✗
Cloud Armor
Why it's wrong here
Cloud Armor is a distributed denial-of-service (DDoS) and web application firewall (WAF) service that protects external-facing HTTP(S) load balancers from application-layer attacks such as cross-site scripting and SQL injection. It operates at the network edge and only inspects incoming traffic destined for published services, not internal VPC traffic or east-west communication. Since the security engineer needs to analyze traffic within the VPC, Cloud Armor's edge-only scope is insufficient.
- ✓
Cloud IDS
Why this is correct
Cloud IDS is a fully managed intrusion detection service that performs deep packet inspection (DPI) on all network traffic within a VPC, including both east-west and north-south flows. It leverages the industry-leading threat signatures from Palo Alto Networks to detect malicious payloads, command-and-control communications, and other network-based attacks. By comparing packet payloads against known signatures, Cloud IDS provides real-time visibility into actual traffic content, directly meeting the requirement to analyze network traffic for threats.
- ✗
VPC Flow Logs
Why it's wrong here
VPC Flow Logs record metadata about IP traffic flows in a VPC, such as source and destination IP addresses, ports, protocols, and packet or byte counts. They do not capture the payload of the packets, so they cannot be used to identify malicious content embedded in the traffic. Flow Logs are useful for connectivity monitoring, troubleshooting, and forensic network mapping, but they are not an intrusion detection mechanism.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Project
A project is a temporary endeavor with a defined beginning and end, undertaken to create a unique product, service, or result, managed through specific processes in IT environments.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.