To proactively identify novel/emerging attack patterns targeting Google Cloud in near real-time, which configuration should you implement?

• A. Configure an Applied Threat Intelligence Fusion Feed in SecOps and develop YARA-L rules to search ingested telemetry.
• B. Use built-in ETD threat intelligence in SCCE.
• C. Route logs to BigQuery and scheduled queries with open-source threat intel feeds.
• D. Use Cloud Armor WAF rule sets and Adaptive Protection with GTI.

Answer: (B)

The thing being tested is how to detect new and emerging attack patterns in Google Cloud in real time by using a managed, continuously updated threat-detection service. The best approach is to enable and rely on the built-in Event Threat Detection threat intelligence in Security Command Center Enterprise. This capability is designed to ingest and correlate telemetry across your Google Cloud resources with ongoing threat intel updates, so you can surface near real-time alerts on novel or evolving attack patterns without having to build and maintain a lot of custom rules yourself. It provides timely detection of suspicious activity as attackers adapt, leveraging Google's threat intelligence feeds and smart detection rules that are kept up to date by the service.

Alternatives that rely on custom fusion feeds with YARA-L rules add significant operational overhead and delay, since you must design, test, and maintain those rules and their data sources. Routing logs to BigQuery with scheduled queries and open-source threat intel feeds is more batch-oriented and depends on external feeds, which may not deliver the rapid, integrated detection you need for emerging threats. Using Cloud Armor at the edge with Adaptive Protection and GTI focuses on protecting externally facing apps from known indicators and edge-based threats, but it doesn’t provide the comprehensive, near real-time visibility into novel patterns across your entire Google Cloud environment.