Question

A security operations team at a financial services company needs to investigate a suspected data exfiltration incident. Several private VMs in a subnet use Cloud NAT for outbound internet access to reach a partner API. The team needs to determine exactly which destination IP addresses and ports the VMs connected to during a specific time window, and whether any connections were dropped due to NAT port exhaustion. Currently no NAT observability is configured. What should the team enable to obtain this evidence with the least operational overhead?

Accepted Answer

Enable Cloud NAT logging on the NAT gateway with the filter set to log both translations and errors, then query the logs in Cloud Logging.

Answer

Enable VPC Flow Logs on the subnet and correlate the internal source IPs with the NAT external IP manually to identify destinations.

Answer

Deploy a packet mirroring policy on the subnet and forward captured traffic to a collector instance for full packet analysis.

Answer

Enable Firewall Rules Logging on the egress allow rule and inspect the connection tuples for the affected VMs.