Using VPC Flow Logs for Network Anomaly Detection

PCSE By islever Editorial Last updated

Configuring boundary segmentation.

Short answer

C Enable VPC Flow Logs on the subnet to capture network flow metadata for identifying anomalies across internal, internet, and Google Cloud traffic.

Question

Your company requires the security and network engineering teams to identify all network anomalies within and across VPCs, internal traffic from VMs to VMs,
traffic between end locations on the internet and VMs, and traffic between VMs to Google Cloud services in production. Which method should you use?
  1. Define an organization policy constraint.
  2. Configure packet mirroring policies.
  3. Enable VPC Flow Logs on the subnet. Correct Answer
  4. Monitor and analyze Cloud Audit Logs.

Key Takeaways

The trap is confusing deep packet inspection (Packet Mirroring) with flow-level metadata analysis (VPC Flow Logs). For general anomaly detection, metadata is sufficient and more scalable.

This PCSE question explores how to detect network anomalies across VPCs using VPC Flow Logs versus Packet Mirroring. The correct answer is C, as Flow Logs provide essential metadata for identifying suspicious traffic patterns efficiently.

Common mistake: Candidates often choose B (Packet Mirroring) believing that 'anomalies' require payload inspection. However, Flow Logs are designed for monitoring and detecting anomalous traffic patterns based on headers and counters, which is the primary goal here.

Expert Analysis

The question asks for a method to identify all network anomalies across various traffic types (internal, internet, and Google Cloud services) within and across VPCs. The key distinction lies between VPC Flow Logs and Packet Mirroring.

VPC Flow Logs (Option C) provide metadata about IP traffic going through network interfaces in your VPC. They capture information such as source/destination IPs, ports, protocol, and bytes/packets count. This data is sufficient for identifying anomalies like unusual traffic volumes, unexpected connections, or port scanning activities without capturing the actual packet payload. Since the requirement is to "identify" anomalies rather than perform deep packet inspection for specific attack signatures, Flow Logs are the standard, scalable solution. They cover internal VM-to-VM, internet-to-VM, and VM-to-Google service traffic seamlessly at the subnet or VPC level.

Packet Mirroring (Option B) copies full network packets (headers and payload) to a security appliance or analysis tool. While powerful for deep inspection, it is resource-intensive, limited to specific VM instances or routes, and often requires additional infrastructure (like a mirror target). Comments suggesting Packet Mirroring argue that it catches "all" anomalies by inspecting payloads, but this is an over-engineered approach for general anomaly identification and doesn't scale well across all VPC traffic as easily as Flow Logs. Furthermore, comments noting limitations of Packet Mirroring regarding cross-VPC or broad coverage align with the practicality of Flow Logs.

Therefore, VPC Flow Logs are the correct choice because they provide comprehensive visibility into network flows for security analysis and anomaly detection without the overhead and complexity of mirroring every packet.

Official Reference

https://cloud.google.com/vpc/docs/flow-logs

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question asks for 'monitoring', 'logging', or 'identifying anomalies' in a cloud networking context, prioritize log-based solutions (like Flow Logs or Cloud Logging) over real-time packet inspection tools (like Packet Mirroring) unless deep packet inspection is explicitly required. Log-based solutions are typically more scalable and cost-effective for broad visibility.

Frequently Asked Questions

Why not use Packet Mirroring for anomaly detection?

Packet Mirroring captures full packet payloads, which is resource-intensive and complex to manage at scale. It is best for deep inspection of specific suspicious traffic, whereas Flow Logs provide sufficient metadata for broad anomaly detection.

What kind of data do VPC Flow Logs collect?

Flow Logs collect metadata including source/destination IPs, ports, protocols, and byte/packet counts. This data is ideal for identifying unusual traffic patterns, volume spikes, or unauthorized access attempts.

More PCSE FAQ →

Community Votes

B
56%
C
44%

56% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 15 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 15

  1. Tabayashi 👍 13
    I think the answer is (C). VPC Flow Logs samples each VM's TCP, UDP, ICMP, ESP, and GRE flows. Both inbound and outbound flows are sampled. These flows can be between the VM and another VM, a host in your on-premises data center, a Google service, or a host on the internet. https://cloud.google.com/vpc/docs/flow-logs
  2. hybridpro 👍 8
    B should be the answer. For detecting network anomalies, you need to have payload and header data as well to be effective. Besides C is saying to enable VPC flow logs on a subnet which won't serve our purpose either.
  3. AwesomeGCP 👍 5 Answered B
    B. Configure packet mirroring policies.
  4. tifo16 👍 3
    https://cloud.google.com/vpc/docs/packet-mirroring#enterprise_security Security and network engineering teams must ensure that they are catching all anomalies and threats that might indicate security breaches and intrusions. They mirror all traffic so that they can complete a comprehensive inspection of suspicious flows. Because attacks can span multiple packets, security teams must be able to get all packets for each flow.
  5. hcnh 👍 3 Answered C
    C is the answer as B has the limitation against question The mirroring happens on the virtual machine (VM) instances, not on the network. Consequently, Packet Mirroring consumes additional bandwidth on the VMs.
Show 10 more comments
  1. mikesp 👍 3 Answered C
    VPC Flow Logs also helps you perform network forensics when investigating suspicious behavior such as traffic from access from abnormal sources or unexpected volumes of data migration
  2. GHOST1985 👍 2 Answered B
    100% Answer B: Anomalies means packet miroiring https://cloud.google.com/vpc/docs/packet-mirroring#enterprise_security "Packet Mirroring is useful when you need to monitor and analyze your security status. It exports all traffic, not only the traffic between sampling periods. For example, you can use security software that analyzes mirrored traffic to detect all threats or anomalies. Additionally, you can inspect the full traffic flow to detect application performance issues. For more information, see the example use cases." https://cloud.google.com/vpc/docs/packet-mirroring
  3. Rightsaidfred 👍 2
    As it is a close tie and ambiguity between B&C, I would say it is C - VPC Flow Logs in this instance, as Question 121 is focusing more on Packet Mirroring with the IDS Use Case.
  4. tifo16 👍 2
    Should be B
  5. dija123 👍 1 Answered B
    Backet mirroring policies allow you to mirror all traffic passing through a specific network interface or VPC route to a designated destination (e.g., another VM, a Cloud Storage bucket). This captured traffic can then be analyzed by security and network engineers using tools like Suricata or Security Command Center for advanced anomaly detection. This approach provides the necessary level of detail and flexibility for identifying anomalies across all the mentioned traffic types
  6. sebG35 👍 1
    The answer is C. The needs is identify all network anomalies within and across VPCs, internal traffic from VMs to VMs ... B- Does not meet all needs. It is limited to the VM and don't cover the needs : across VPCs https://cloud.google.com/vpc/docs/packet-mirroring?hl=en C- Cover all needs https://cloud.google.com/vpc/docs/flow-logs?hl=en
  7. tangac 👍 1 Answered C
    First you can use VPC flow log at a subnet level : https://cloud.google.com/vpc/docs/using-flow-logs Then VPC Flow Log main feature is to collect logs that can be used for network monitoring, forensics, real-time security analysis, and expense optimization.
  8. irmingard_examtopics 👍 1 Answered C
    B is overkill, no need for play load inspection here. Question should either say there is only one subnet or C should say the enable on all subnets.
  9. b6f53d8 👍 1
    C is only for subnet, and we need control in many VPCs, so I prefer B
  10. jvkubjg 👍 1 Answered B
    Anomalies -> Packet Mirroring

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

Integrating On-Premises Active Directory with Google Cloud IAM

S-grade

Cloud External Key Manager and Confidential VM Implementation Constraints

S-grade

← Back to PCSE Study Guide