Cloud Digital Leader Google Cloud Security Practice Question
A security engineer needs to monitor and analyze security logs from multiple GCP projects and on-premises sources in a centralized SIEM. Which Google Cloud service is designed for log management and security analytics at scale?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Chronicle
Chronicle is Google Cloud's SIEM platform that ingests logs from various sources and provides security analytics. Security Command Center is for vulnerability management, not a SIEM. Cloud Logging is for log storage and basics, but not a full SIEM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Logging
Why it's wrong here
Cloud Logging is a fully managed service that ingests, stores, and lets you query logs from Google Cloud resources using Logs Explorer and Logs Analytics. However, it is a log management tool without built-in SIEM capabilities such as cross-source correlation, threat detection rules, or automated incident alerting. You would need to export logs to a dedicated SIEM like Chronicle to perform advanced security analytics.
- ✓
Chronicle
Why this is correct
Chronicle is Google Cloud's cloud-native SIEM purpose-built for ingesting massive volumes of security telemetry, normalizing it, and running continuous threat detection. Unlike simpler log tools, it provides automated correlation, an entity graph, and detection rules that enable security teams to hunt for and investigate threats. It integrates with Cloud Logging and other sources, making it the correct choice for security log monitoring and analysis.
- ✗
Security Command Center
Why it's wrong here
Security Command Center (SCC) is a security and risk management platform that centralizes asset inventory, vulnerability scanning, and threat detection findings like anomaly detection and policy violations. It surfaces actionable findings from across Google Cloud, but it does not ingest arbitrary application or infrastructure logs for open-ended querying or advanced log correlation. Thus, while SCC complements a SIEM, it is not a SIEM for security log analysis.
- ✗
Cloud IDS
Why it's wrong here
Cloud IDS is a managed network intrusion detection service that inspects VPC traffic against Suricata-based rules to identify known threats and policy violations at the network layer. It analyzes packet flows only, not application, host, or security logs, and provides no log storage, correlation, or advanced SIEM analytics. Cloud IDS focuses on detecting network-level attacks in real time rather than managing and analyzing security logs across the stack.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.