How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?
Your organization is using Security Command Center Premium as a central tool to detect and alert on security threats. You also want to alert on suspicious outbound traffic that is targeting domains of known suspicious web services. What should you do?
Community Votes
56% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests native Threat Intelligence integration in Firewall Policies, with the common trap being the unnecessary introduction of external SIEM tools like Chronicle when built-in capabilities suffice.
This PCSE exam question tests how to leverage Google Cloud’s native Threat Intelligence integration within VPC Firewall Policies to detect and alert on malicious outbound traffic. The community consensus confirms that integrating TI lists directly into egress firewall rules is the most efficient and cost-effective solution alongside Security Command Center Premium.
Option B (Forward logs to Chronicle) is frequently chosen due to its prominence in enterprise security, but it introduces unnecessary complexity and cost since VPC Firewall Policies natively support TI-based alerting and integrate directly with SCC Premium.
Community Discussion (9 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Google Cloud VPC Firewall Policies natively support Threat Intelligence integration, allowing administrators to match destination IPs and domains against curated malicious lists. By configuring an egress rule with a Threat Intelligence list as the destination, the firewall automatically logs and alerts on suspicious outbound traffic before it reaches the internet. This capability feeds directly into Security Command Center Premium, providing centralized detection without additional infrastructure. As noted in official documentation, firewall policies can secure networks by allowing or blocking traffic based on Google Threat Intelligence data.Why the Other Options Are Wrong
Option A relies on Cloud DNS logging, which captures query activity but lacks the centralized enforcement and threat-matching capabilities required for outbound traffic alerts. Option B incorrectly introduces Chronicle, a separate enterprise SIEM product that adds unnecessary cost and complexity when native SCC Premium integration already solves the requirement. Option C deploys a Cloud IDS endpoint, which focuses on deep packet inspection and signature-based intrusion detection rather than domain-level threat intelligence filtering. None of these alternatives provide the direct, cost-efficient alignment with SCC Premium that option D offers.Community Comment Notes
The voting split between options B and D highlights a common dilemma regarding SIEM selection versus native cloud controls. Multiple users initially favored Chronicle due to its enterprise reputation, but several comments clarified that VPC Firewall Policies natively handle TI-based alerting. Commenters referencing the official firewall policy documentation confirmed that threat intelligence lists can be attached directly to egress rules. One user correctly pointed out that SCC Premium already covers alerting needs, making third-party log forwarding redundant. The consensus ultimately shifted toward option D after verifying native integration capabilities.Official Reference
Exam Strategy
Always prioritize native Google Cloud integrations over third-party or additional paid services unless explicitly required by the scenario. When SCC Premium is mentioned, look for solutions that natively feed logs or events into it without middleware.
Frequently Asked Questions
Why isn't forwarding logs to Chronicle the right choice here?
Chronicle is a separate, costly SIEM platform not mentioned in the scenario. Native VPC Firewall Policies with Threat Intelligence integrate directly with SCC Premium, making Chronicle unnecessary.
How does Threat Intelligence work with VPC Firewall Policies?
You can attach prebuilt Google Threat Intelligence lists to firewall rules. The system automatically matches destination IPs/domains against these lists to allow, deny, or log traffic.