mediumMultiple ChoiceObjective-mapped
PCSE Practice Question: Needs to investigate a potential data…
A security engineer needs to investigate a potential data exfiltration incident in a Google Cloud environment. The engineer has access to Cloud Logging and wants to identify any unusual outbound network traffic from Compute Engine instances. Which log sink filter should the engineer create to capture VPC flow logs for traffic destined to an external IP address not in the internal network ranges?
⚠ Common exam trap
Google Cloud often tests the misconception that you can use `0.0.0.0/0` as a wildcard in log filters to match any IP, but in Cloud Logging filters, CIDR notation is not supported for matching; you must explicitly exclude private ranges to capture external traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a sink with filter: 'resource.type="gce_subnetwork" AND jsonPayload.connection.dest_ip!="10.0.0.0/8" AND jsonPayload.connection.dest_ip!="172.16.0.0/12" AND jsonPayload.connection.dest_ip!="192.168.0.0/16"'
It uses a log sink filter that captures VPC flow logs for traffic destined to external IP addresses by explicitly excluding the private RFC 1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). This filter ensures only outbound traffic to non-internal IPs is captured, which is essential for investigating potential data exfiltration. The filter correctly uses the `resource.type="gce_subnetwork"` to target VPC flow logs from Compute Engine instances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a sink with filter: 'resource.type="gce_subnetwork" AND jsonPayload.connection.dest_ip="0.0.0.0/0"'
Why it's wrong here
Source IP filter is irrelevant; also the filter syntax is incorrect.
- ✗
Create a sink with filter: 'resource.type="gce_subnetwork" AND jsonPayload.reporter="src" AND jsonPayload.connection.dest_ip="0.0.0.0/0"'
Why it's wrong here
Filtering on reporter=src and dest_ip=0.0.0.0/0 is not valid; also it captures only traffic reported by source.
- ✓
Create a sink with filter: 'resource.type="gce_subnetwork" AND jsonPayload.connection.dest_ip!="10.0.0.0/8" AND jsonPayload.connection.dest_ip!="172.16.0.0/12" AND jsonPayload.connection.dest_ip!="192.168.0.0/16"'
Why this is correct
This filter captures VPC flow logs where destination IP is not in private ranges, thus external traffic.
- ✗
Create a sink with filter: 'compute.googleapis.com/vpc_flows'
Why it's wrong here
This filter captures all VPC flow logs, which is too broad and not focused on external traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.