How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

PCSE By islever Editorial Last updated

Short answer

D Create an egress firewall policy with Threat Intelligence as the destination to natively detect and alert on malicious outbound traffic via SCC Premium.

Question

Your organization is using Security Command Center Premium as a central tool to detect and alert on security threats. You also want to alert on suspicious outbound traffic that is targeting domains of known suspicious web services. What should you do?
  1. Create a DNS Server Policy in Cloud DNS and turn on logs. Attach this policy to all Virtual Private Cloud networks with internet connectivity.
  2. Forward all logs to Chronicle Security Information and Event Management. Create an alert for suspicious egress traffic to the internet.
  3. Create a Cloud Intrusion Detection endpoint. Connect this endpoint to all Virtual Private Cloud networks with internet connectivity.
  4. Create an egress firewall policy with Threat Intelligence as the destination. Attach this policy to all Virtual Private Cloud networks with internet connectivity. Correct Answer

Key Takeaways

Tests native Threat Intelligence integration in Firewall Policies, with the common trap being the unnecessary introduction of external SIEM tools like Chronicle when built-in capabilities suffice.

This PCSE exam question tests how to leverage Google Cloud’s native Threat Intelligence integration within VPC Firewall Policies to detect and alert on malicious outbound traffic. The community consensus confirms that integrating TI lists directly into egress firewall rules is the most efficient and cost-effective solution alongside Security Command Center Premium.

Common mistake: Option B (Forward logs to Chronicle) is frequently chosen due to its prominence in enterprise security, but it introduces unnecessary complexity and cost since VPC Firewall Policies natively support TI-based alerting and integrate directly with SCC Premium.

Expert Analysis

Why the Answer Is Correct

Google Cloud VPC Firewall Policies natively support Threat Intelligence integration, allowing administrators to match destination IPs and domains against curated malicious lists. By configuring an egress rule with a Threat Intelligence list as the destination, the firewall automatically logs and alerts on suspicious outbound traffic before it reaches the internet. This capability feeds directly into Security Command Center Premium, providing centralized detection without additional infrastructure. As noted in official documentation, firewall policies can secure networks by allowing or blocking traffic based on Google Threat Intelligence data.

Why the Other Options Are Wrong

Option A relies on Cloud DNS logging, which captures query activity but lacks the centralized enforcement and threat-matching capabilities required for outbound traffic alerts. Option B incorrectly introduces Chronicle, a separate enterprise SIEM product that adds unnecessary cost and complexity when native SCC Premium integration already solves the requirement. Option C deploys a Cloud IDS endpoint, which focuses on deep packet inspection and signature-based intrusion detection rather than domain-level threat intelligence filtering. None of these alternatives provide the direct, cost-efficient alignment with SCC Premium that option D offers.

Community Comment Notes

The voting split between options B and D highlights a common dilemma regarding SIEM selection versus native cloud controls. Multiple users initially favored Chronicle due to its enterprise reputation, but several comments clarified that VPC Firewall Policies natively handle TI-based alerting. Commenters referencing the official firewall policy documentation confirmed that threat intelligence lists can be attached directly to egress rules. One user correctly pointed out that SCC Premium already covers alerting needs, making third-party log forwarding redundant. The consensus ultimately shifted toward option D after verifying native integration capabilities.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always prioritize native Google Cloud integrations over third-party or additional paid services unless explicitly required by the scenario. When SCC Premium is mentioned, look for solutions that natively feed logs or events into it without middleware.

Frequently Asked Questions

Why isn't forwarding logs to Chronicle the right choice here?

Chronicle is a separate, costly SIEM platform not mentioned in the scenario. Native VPC Firewall Policies with Threat Intelligence integrate directly with SCC Premium, making Chronicle unnecessary.

How does Threat Intelligence work with VPC Firewall Policies?

You can attach prebuilt Google Threat Intelligence lists to firewall rules. The system automatically matches destination IPs/domains against these lists to allow, deny, or log traffic.

More PCSE FAQ →

Community Votes

D
56%
B
44%

56% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. brpjp 👍 3
    Answer D is correct as per Gemini: Subscribe to threat intelligence feeds that provide updated lists of known suspicious domains and IP addresses. Integrate these feeds with your security solutions to identify and block outbound connections to these resources.
  2. BondleB 👍 3 Answered B
    https://cloud.google.com/chronicle/docs/overview Option B addresses the alert on suspicious outbound traffic while option D does not.
  3. Zek 👍 1 Answered D
    D seems right to me. https://cloud.google.com/firewall/docs/firewall-policies-rule-details#threat-intelligence-fw-policy Firewall policy rules let you secure your network by allowing or blocking traffic based on Google Threat Intelligence data. For egress rules, specify the destination by using one or more destination Google Threat Intelligence lists.
  4. cachopo 👍 1 Answered D
    The correct option is D. Since it is not necessary to send logs to Chronicle if you are already paying for SCC Premium, which can alert on any outbound traffic that triggers the Threat Intelligence firewall rule. Otherwise, I don't see any point in them explicitly telling you that you have contracted SCC Premium.
  5. Pime13 👍 1 Answered D
    https://cloud.google.com/security-command-center/docs/concepts-security-command-center-overview#cases-overview
Show 4 more comments
  1. MoAk 👍 1 Answered D
    https://cloud.google.com/firewall/docs/firewall-policies-rule-details#threat-intelligence-fw-policy
  2. Pach1211 👍 2
    I´m thinking D
  3. yokoyan 👍 1 Answered B
    I think it's B.
  4. sanmeow 👍 1 Answered D
    D is correct.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

How to Manage Corporate and Public User Identities in Google Cloud?

S-grade

← Back to PCSE Study Guide