Question

A security operations team has integrated SCC, Google SecOps, GTI, and Cloud IDS. During a purple-team exercise, the red team exfiltrated data from a Compute Engine VM to an external attacker-controlled host over an encrypted channel on a non-standard port. SecOps received VPC Flow Log telemetry showing the connection, but no alert fired identifying the traffic as malicious, and Cloud IDS produced no signature match. Which conclusion best identifies the coverage gap and the most appropriate remediation?

Accepted Answer

Cloud IDS relies on deep packet inspection of mirrored traffic and cannot inspect encrypted payloads; add a SecOps YARA-L rule correlating VPC Flow Log egress volume and rare destinations against GTI to detect the behavior.

Answer

SCC Security Health Analytics should have flagged the exfiltration; enable additional SHA detectors and forward findings to SecOps to close the gap.

Answer

The gap is caused by Cloud IDS being deployed in the wrong region; redeploy the IDS endpoint in the VM's region to enable signature matching on the encrypted flow.

Answer

GTI should have automatically blocked the destination; enable GTI inline enforcement on the VPC to prevent the connection.