Professional Security Operations EngineerDemo

Question

You are using Google Security Operations (SecOps) to detect and report a recurring series of brute-force SSH sign-in attempts against a Compute Engine image that did not lead to a successful login. You need visibility into this activity while minimizing the effect on your ingestion quota. Which log type should you ingest into Google SecOps?

A VPC Flow Logs
B Security Command Center Premium (SCCP) findings
C Cloud IDS logs
D Cloud Audit Logs

Explanation

VPC Flow Logs capture sampled network flows to and from VM instances and aggregate packets for an IP connection into flow records, allowing repeated SSH connections to be identified without ingesting full guest authentication logs. Their filtering, secondary sampling, and aggregation settings can reduce log volume. Security Command Center Premium’s Brute Force: SSH finding detects a successful brute-force SSH attack, so it does not cover a sequence that never succeeds.

Learn more

Professional Security Operations EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ50

Community Discussion