Examkin

Question

Difficulty: HardSecurity Logging, Audit Logs, and Security Command Center

A enterprise fintech organization is implementing real-time threat detection and security event streaming using Security Command Center (SCC) Premium. The Cloud Security Architect must configure an automated workflow that exports SCC threat findings to an on-premises Security Information and Event Management (SIEM) system via Pub/Sub. The design must ensure that even if an internal user or service account credential becomes compromised, log payload data cannot be exfiltrated to external Storage buckets or Pub/Sub topics outside the organization's managed boundary. Which architectural configuration meets these security and compliance requirements?

  1. Configure an organization-level SCC Continuous Export to a Pub/Sub topic protected within a VPC Service Controls perimeter, granting the SCC service agent the minimal Pub/Sub Publisher role on the topic.Answer
  2. B
    Rely strictly on granular IAM policy bindings on the Pub/Sub topic to restrict subscriber permissions to designated service accounts, avoiding VPC Service Controls to minimize operational complexity.
  3. C
    Assign the Project Editor primitive role to the SCC export service account at the organization node to ensure uninterrupted access across all current and future Pub/Sub topics.
  4. D
    Grant the Service Account Admin role to the export pipeline worker identity so it can dynamically generate short-lived keys and manage service account delegation during data streaming.

Answer

Configure an organization-level SCC Continuous Export to a Pub/Sub topic protected within a VPC Service Controls perimeter, granting the SCC service agent the minimal Pub/Sub Publisher role on the topic.
The combination of SCC Continuous Export, least-privilege predefined IAM roles (Pub/Sub Publisher), and VPC Service Controls fulfills both real-time streaming needs and stringent exfiltration prevention. VPC Service Controls act as a perimeter boundary that stops data movement to unauthorized destinations outside the service perimeter, even if credentials are compromised.

Step-by-Step Solution

1
Identify the proper SCC notification mechanism for real-time finding export.
SCC Continuous Export automatically routes newly generated findings directly to a designated Pub/Sub topic in real time.
Batch log sinks or manual queries do not meet real-time streaming requirements to external SIEM systems.
2
Apply least privilege access to the SCC service agent.
Grant only `roles/pubsub.publisher` on the target Pub/Sub topic.
Prevents over-privileging the service account with broad administrative or primitive roles.
3
Implement perimeter controls against data exfiltration.
Enclose the Pub/Sub topic and consuming services inside a VPC Service Controls perimeter.
VPC Service Controls block data transfer requests to resources outside the defined security perimeter regardless of IAM authorization.

Key Concept

Combining Security Command Center Continuous Export with VPC Service Controls and Least-Privilege IAM to secure real-time security finding egress.
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic