Examkin

Question

Difficulty: MediumSecurity Logging, Audit Logs, and Security Command Center

An enterprise security architect is designing a centralized log aggregation framework across a multi-project Google Cloud organization. Cloud Audit Logs from all projects are exported via an organization-level log sink into a central Cloud Storage bucket. Security policy mandates that while authorized security analysts require read access to inspect audit records, they must be strictly prevented from copying or exfiltrating log data to Cloud Storage buckets residing outside the corporate GCP organization perimeter. Which architectural control should be implemented to satisfy this requirement?

  1. A
    Configure fine-grained IAM object viewer permissions on the central log storage bucket and rely exclusively on IAM controls to block unauthorized exfiltration to external destinations.
  2. Establish a VPC Service Controls perimeter around the project hosting the central log storage bucket to restrict data egress to external Google Cloud projects and organizations.Answer
  3. C
    Enforce Customer-Supplied Encryption Keys (CSEK) on the central log storage bucket to block unauthorized exfiltration of raw log contents.
  4. D
    Assign the primitive Owner IAM role on the central logging project to the security analysis team to grant full log visibility and management capability.

Answer

Establish a VPC Service Controls perimeter around the project hosting the central log storage bucket to restrict data egress to external Google Cloud projects and organizations.
VPC Service Controls allow organizations to establish a security perimeter around GCP services (such as Cloud Storage containing aggregated audit logs). This prevents data exfiltration by blocking API requests that attempt to copy data from inside the perimeter to resources outside the perimeter, even when the user possesses valid IAM read permissions.

Step-by-Step Solution

1
Analyze security and compliance requirements
Identified the need to allow security analysts read access to central audit logs while preventing data exfiltration to external GCP resources.
Standard IAM permissions allow users with read access to write data to any external bucket they have access to.
2
Evaluate GCP perimeter security capabilities
Determined that VPC Service Controls provide context-aware perimeter boundaries that block unauthorized data movement (egress/ingress) across project boundaries.
VPC Service Controls protect against data exfiltration risks that IAM alone cannot mitigate.
3
Select the optimal control
Enclose the centralized logging storage bucket within a VPC SC security perimeter with strict egress rules.
This guarantees that audit log data remains inside the trusted perimeter regardless of user IAM privileges.

Key Concept

Data Exfiltration Prevention with VPC Service Controls
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic