Examkin

Question

Difficulty: MediumSecurity Logging, Audit Logs, and Security Command Center

An enterprise organization requires all Data Access audit logs from multiple Google Cloud projects to be aggregated into a central Cloud Storage bucket for compliance auditing. The security architecture must prevent authorized internal analysts from exfiltrating logs to external locations outside the organization, ensure encryption key lifecycle management is handled via Google Cloud services rather than raw customer keys, and grant log processing applications minimal impersonation permissions without granting administrative control over identity resources. Which architecture should you implement?

  1. Configure an aggregated log sink targeting a central Cloud Storage bucket, protect the storage bucket within a VPC Service Controls perimeter, encrypt the bucket using Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and assign the Service Account User role to processing workloads.Answer
  2. B
    Configure an aggregated log sink targeting a central Cloud Storage bucket, rely exclusively on restrictive IAM roles to prevent audit log exfiltration, encrypt the bucket using Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and assign the Service Account User role to processing workloads.
  3. C
    Configure an aggregated log sink targeting a central Cloud Storage bucket, protect the storage bucket within a VPC Service Controls perimeter, encrypt the destination bucket using Customer-Supplied Encryption Keys (CSEK) supplied per API request, and assign the Service Account User role to processing workloads.
  4. D
    Configure an aggregated log sink targeting a central Cloud Storage bucket, protect the storage bucket within a VPC Service Controls perimeter, encrypt the bucket using Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and assign the Service Account Admin role to processing workloads.

Answer

The correct solution requires implementing an aggregated log sink to a central Cloud Storage bucket protected by VPC Service Controls, encrypting the storage bucket with Customer-Managed Encryption Keys (CMEK) in Cloud KMS, and assigning the Service Account User role to log processing workloads.
The correct implementation combines VPC Service Controls to prevent authorized users from moving audit logs outside the defined perimeter, CMEK for managing key lifecycles natively in Cloud KMS without managing raw keys, and the Service Account User role to satisfy least privilege for log processing workloads.

Step-by-Step Solution

1
Evaluate data exfiltration controls for centralized audit storage
Identify that IAM controls determine who can access data, but VPC Service Controls is required to prevent authorized users from exfiltrating data outside the network perimeter.
VPC Service Controls creates a security boundary around GCP services to prevent unauthorized data transfers to external resources.
2
Determine key management requirements for audit log storage
Select Customer-Managed Encryption Keys (CMEK) utilizing Cloud KMS instead of Customer-Supplied Encryption Keys (CSEK).
CMEK fulfills cloud governance and key rotation mandates while leveraging Cloud KMS, avoiding the burden of storing and supplying raw keys for automated log sinks.
3
Apply least-privilege identity configuration for workload service accounts
Grant the Service Account User role (roles/iam.serviceAccountUser) to workloads that need to run under the service account identity.
Service Account Admin grants full control to create and delete service accounts, violating the principle of least privilege.

Key Concept

Centralized Security Logging with VPC Service Controls, CMEK, and Least-Privilege IAM
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic