Cloud Digital Leader Google Cloud Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud KMS

  Why it's wrong here

  Cloud KMS is a cryptographic key management service that creates, rotates, and stores encryption keys; it does not ingest or analyze logs, network traffic, or security telemetry. Since it is not a security monitoring or detection service, it is unsuitable for use cases involving real-time threat detection and response. Organizations use KMS to protect data at rest, not to investigate security incidents.

• ✓

  Chronicle

  Why this is correct

  Chronicle is Google Cloud's SIEM offering that ingests large volumes of telemetry and log data, normalizes it, and applies analytics and detection rules to identify suspicious activity. It correlates events across multiple data sources with context like user and network behavior, enabling security teams to prioritize and respond to threats. As a SIEM, Chronicle is designed specifically for centralized security analytics and incident investigation.

• ✓

  Cloud IDS

  Why this is correct

  Cloud IDS is a managed intrusion detection service that performs deep packet inspection (DPI) on network traffic flowing through Google Cloud, matching it against threat signatures from providers like Palo Alto Networks. It provides real-time detection of network-based attacks such as malware, command-and-control traffic, and lateral movement. By generating findings when malicious activity is observed, Cloud IDS gives security teams visibility into network-level threats.

• ✗

  Cloud Armor

  Why it's wrong here

  Cloud Armor is a web application firewall (WAF) and DDoS protection service that operates at the load-balancing layer, filtering HTTP/HTTPS traffic based on preconfigured rules and threat intelligence. It is not designed to inspect general network packets or analyze internal network traffic; it focuses on protecting applications from web-based attacks like SQL injection, XSS, and OWASP Top 10 threats. While useful for application security, Cloud Armor does not provide network-level traffic analysis or SIEM functionality.

• ✓

  Security Command Center

  Why this is correct

  Security Command Center (SCC) is a centralized security and data governance platform that aggregates findings from multiple Google Cloud services, including Cloud IDS, Cloud Armor, and threat detection engines. It provides a single view of security posture, vulnerability assessments, and threat detection across the organization, allowing security teams to triage and respond to incidents. SCC acts as a hub for security findings rather than a real-time detection engine itself, enabling correlated response workflows.

Go deeper

Related to this question