A security team needs to analyze network traffic patterns for auditing and anomaly detection. They require a complete record of all TCP/UDP traffic flowing through the VPC network, including source/destination IP, ports, and protocol. Which GCP feature should be enabled?

VPC Flow Logs is the designated Google Cloud feature for recording network traffic information. It captures a sample of network flows to and from VM instances within a VPC subnet. Each log entry contains details such as the source and destination IP addresses, source and destination ports, protocol, and the volume of data transferred. This data is crucial for use cases like network monitoring, security forensics, and real-time security analysis, directly addressing the security team's need to audit traffic patterns and detect anomalies.

A. Cloud NAT logging: This service only records information about connections that pass through a Cloud NAT gateway, not all traffic within the VPC.

C. Cloud Audit Logs: This service records administrative activities and API calls ("who did what, where, and when"), not the details of network traffic flows.

D. Cloud Monitoring metrics: This provides aggregated numerical data, such as total bytes in/out, but lacks the granular, per-flow details (IPs, ports) needed for this type of analysis.

1. Google Cloud Documentation, "VPC Flow Logs overview": "VPC Flow Logs records a sample of network flows sent from and received by VM instances... These logs can be used for network monitoring, forensics, real-time security analysis, and expense optimization." The documentation also lists the specific record format, which includes connection.srcip, connection.destip, connection.srcport, connection.destport, and connection.protocol.

Source: https://cloud.google.com/vpc/docs/using-flow-logs#logrecordformat

2. Google Cloud Documentation, "Cloud Audit Logs overview": "Google Cloud services write audit logs that record administrative activities and accesses within your Google Cloud resources. Cloud Audit Logs helps you answer the questions, 'who did what, where, and when?'"

Source: https://cloud.google.com/logging/docs/audit

3. Google Cloud Documentation, "Use Cloud NAT logging and monitoring": "Cloud NAT logging lets you log NAT connections and errors... Translation logs create a log entry for each successful NAT connection." This confirms its scope is limited to NAT-specific traffic.

Source: https://cloud.google.com/nat/docs/logging-and-monitoring

4. Google Cloud Architecture Center, "Security foundations guide - Logging and monitoring": "Enable VPC Flow Logs for subnets that contain critical workloads to record all network flows (ingress and egress) for those subnets. You can use VPC Flow Logs for network forensics and to provide a baseline for traffic patterns."

Source: https://cloud.google.com/architecture/security-foundations/networking-and-connectivity#loggingandmonitoring