What's changed: Created Professional Cloud Security Engineer Chapter 4 (Domain 4 "Operations": CVE scanning in CI/CD (Artifact Analysis)/Binary Authorization (GKE/Cloud Run)/image hardening-VM patch management/CSPM-custom org policies-Security Health Analytics custom modules; network logs (Cloud NGFW/VPC flow logs/Packet Mirroring/Cloud IDS/Log Analytics), logging strategy, incident response, secure log access, external SIEM export, Cloud Audit Logs/data access logs, log sinks/aggregated sinks, Security Command Center).
4.2Logging, monitoring, and threat detection
Understand configuring/analyzing network logs (Cloud NGFW, VPC flow logs, Packet Mirroring, Cloud IDS, Log Analytics), an effective logging strategy, incident logging/monitoring/response/remediation, secure access to logs, exporting logs to external security systems, configuring/analyzing Cloud Audit Logs and data access logs, log exports (log sinks, aggregated sinks), and configuring/monitoring Security Command Center.
Detection and response come from "collect the right logs, find threats, and store/forward them securely." Center the design on audit logs and the security platform.
4.2.1Audit logs and log export
Record "who did what, when" with Cloud Audit Logs. Admin Activity logs are on by default; enable sensitive Data Access logs explicitly. For long-term retention, analysis, and SIEM, export with log sinks to BigQuery/Cloud Storage/Pub/Sub, and use an aggregated sink to collect across an org/folder at once. Export to external security systems (SIEM/SOAR) via Pub/Sub. Prevent tampering/deletion by minimizing access to logs and protecting their destinations. Map "collect org-wide logs at once = aggregated sink" and "audit trail = Cloud Audit Logs (enable Data Access)."
4.2.2Threat detection and incident response
Visualize the network with VPC flow logs, Cloud NGFW logs, and Packet Mirroring (full copy), and detect network-layer intrusions with Cloud IDS (managed IDS). For advanced analysis of large logs, use Log Analytics (BigQuery-based). The threat hub is Security Command Center (SCC): beyond misconfig (Security Health Analytics), it detects threats via Event Threat Detection, Container Threat Detection, and more, driving detection through response/remediation. Handle incidents "detect→triage→contain→remediate." Map "network-layer intrusion detection = Cloud IDS" and "threat hub = Security Command Center."
Common: requirement → means. E.g., "record who accessed data" = Cloud Audit Logs Data Access logs (must enable); "collect org-wide logs to a SIEM at once" = aggregated sink + Pub/Sub; "managed network-layer intrusion detection" = Cloud IDS; "centrally detect threats/misconfig and respond" = Security Command Center; "analyze large logs with SQL" = Log Analytics.
Watch the mix-ups: (1) Data Access logs are off by default—enable them for sensitive-operation trails. (2) Choose log sink (single) vs aggregated sink (org/folder-wide). (3) Cloud IDS (network intrusion detection) vs Security Command Center (cross-cutting threat/misconfig) differ in scope.
4.2.3Section summary
- Trail = Cloud Audit Logs (enable Data Access); org-wide collection = aggregated sink→BigQuery/Pub/Sub
- Network intrusion detection = Cloud IDS; visibility = VPC flow logs/Packet Mirroring; analysis = Log Analytics
- Threat/misconfig hub = Security Command Center; incidents = detect→triage→contain→remediate
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To keep a trail of "who accessed sensitive data, when," what is the prerequisite in Cloud Audit Logs?
Q2. To collect org-wide logs at once and stream them to an external SIEM, which configuration?
Q3. To detect network-layer intrusions and known threat signatures with a managed service, which is best?
Q4. To centrally detect/visualize threats, vulnerabilities, and misconfig org-wide and drive response, which is the hub?
Q5. To run advanced SQL analysis (trends/anomalies) over large accumulated logs, which is best?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.