Cloud Digital Leader Google Cloud Security Practice Question
A security team needs to detect and respond to threats in real time using network traffic analysis and log correlation. Which THREE services should they use? (Choose 3)
⚠ Common exam trap
The trap here is including Cloud Armor because it sounds security-related, but it is a WAF/DDoS service, not a threat detection or log correlation tool; the exam expects you to distinguish between preventive controls (Cloud Armor, Cloud KMS) and detective controls (Chronicle, Cloud IDS, SCC).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Chronicle
Chronicle (B) is correct because it is Google Cloud's security analytics platform that ingests and correlates logs at scale, enabling real-time threat detection through rules and threat intelligence. Cloud IDS (C) is correct because it provides network traffic analysis using Palo Alto Networks technology to detect intrusions, malware, and other threats in real time. Security Command Center (E) is correct because it aggregates findings from multiple sources, including Cloud IDS and other services, to give a centralized view of threats and misconfigurations for response. Cloud KMS (A) is a key management service for encryption keys, not threat detection, and Cloud Armor (D) is a WAF/DDoS protection service that filters traffic but does not perform log correlation or comprehensive threat detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud KMS
Why it's wrong here
Cloud KMS is a cryptographic key management service that creates, rotates, and stores encryption keys; it does not ingest or analyze logs, network traffic, or security telemetry. Since it is not a security monitoring or detection service, it is unsuitable for use cases involving real-time threat detection and response. Organizations use KMS to protect data at rest, not to investigate security incidents.
- ✓
Chronicle
Why this is correct
Chronicle is Google Cloud's SIEM offering that ingests large volumes of telemetry and log data, normalizes it, and applies analytics and detection rules to identify suspicious activity. It correlates events across multiple data sources with context like user and network behavior, enabling security teams to prioritize and respond to threats. As a SIEM, Chronicle is designed specifically for centralized security analytics and incident investigation.
- ✓
Cloud IDS
Why this is correct
Cloud IDS is a managed intrusion detection service that performs deep packet inspection (DPI) on network traffic flowing through Google Cloud, matching it against threat signatures from providers like Palo Alto Networks. It provides real-time detection of network-based attacks such as malware, command-and-control traffic, and lateral movement. By generating findings when malicious activity is observed, Cloud IDS gives security teams visibility into network-level threats.
- ✗
Cloud Armor
Why it's wrong here
Cloud Armor is a web application firewall (WAF) and DDoS protection service that operates at the load-balancing layer, filtering HTTP/HTTPS traffic based on preconfigured rules and threat intelligence. It is not designed to inspect general network packets or analyze internal network traffic; it focuses on protecting applications from web-based attacks like SQL injection, XSS, and OWASP Top 10 threats. While useful for application security, Cloud Armor does not provide network-level traffic analysis or SIEM functionality.
- ✓
Security Command Center
Why this is correct
Security Command Center (SCC) is a centralized security and data governance platform that aggregates findings from multiple Google Cloud services, including Cloud IDS, Cloud Armor, and threat detection engines. It provides a single view of security posture, vulnerability assessments, and threat detection across the organization, allowing security teams to triage and respond to incidents. SCC acts as a hub for security findings rather than a real-time detection engine itself, enabling correlated response workflows.
Visual reference
Go deeper
Related to this question
Learn chapter
Structured vs Unstructured Data Analytics
Key term
Cloud KMS
Cloud KMS (Key Management Service) is a cloud-based service that lets you create, manage, and use encryption keys to protect your data at rest and in transit.
Key term
Security Command Center
Security Command Center is a centralized cloud security management platform that helps organizations detect, investigate, and respond to threats across their cloud infrastructure.
About these practice questions
This GCDL question is part of Courseiva's 848-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.