Question

A security operations engineer is evaluating tool effectiveness across the organization's Google Cloud environment. The current stack includes Security Command Center (SCC) for posture and misconfiguration findings, Cloud IDS for network-layer intrusion detection on VPC traffic, and Google SecOps ingesting audit and platform logs. During a tabletop exercise, the team notes that a compromised Cloud Run service executing malicious code was not detected until data exfiltration triggered a downstream alert. Which conclusion best identifies the coverage gap the engineer should address?

Accepted Answer

Cloud IDS lacks visibility into the internal process and application-layer behavior of the serverless workload, and no runtime threat detection source (such as container/workload runtime telemetry) feeds SecOps to catch in-process malicious execution.

Answer

SCC posture management should have blocked the malicious code execution automatically, so the gap is a misconfigured SCC auto-remediation policy.

Answer

Cloud IDS was likely disabled on the subnet, so re-enabling network intrusion detection would have detected the in-process code execution.

Answer

The gap is purely a SecOps parsing issue; a custom parser for Cloud Run request logs would have surfaced the malicious execution in real time.