Examkin

Question

Difficulty: HardSecurity Logging, Audit Logs, and Security Command Center

An enterprise security architect must establish organization-wide Data Access audit logging for sensitive Cloud Storage resources, store the logs in an immutable archive encrypted with customer-managed keys, and enable Security Command Center (SCC) detection for storage bucket misconfigurations. Arrange the configuration steps in the correct chronological sequence to implement this operational pipeline.

  1. 1Configure the Organization-level IAM Audit Configuration to explicitly enable Data Access audit logs (ADMIN_READ, DATA_READ, DATA_WRITE) for Cloud Storage.
  2. 2Provision a centralized Cloud Storage logging bucket configured with a Bucket Lock retention policy and encrypted using a Cloud KMS Customer-Managed Encryption Key (CMEK).
  3. 3Create an Organization-level aggregated Cloud Logging sink specifying the centralized storage bucket URI as the destination and an inclusion filter for Cloud Storage Data Access logs.
  4. 4Grant the unique service account writer identity of the aggregated log sink the Storage Object Creator role on the centralized storage logging bucket.
  5. 5Enable Security Command Center Premium and activate Security Health Analytics detectors to continuously monitor storage buckets for open access or policy violations.

Answer

The correct operational sequence begins by enabling Data Access Audit Logs at the organization level, followed by provisioning the destination CMEK-encrypted Cloud Storage bucket with Bucket Lock. Next, the organization-level aggregated log sink is created to obtain its unique writer service account identity. Then, that service account identity is granted the Storage Object Creator role on the destination storage bucket. Finally, Security Command Center Security Health Analytics modules are enabled to provide posture monitoring.
Building an enterprise security logging and monitoring pipeline requires respecting GCP resource dependencies. First, audit log generation must be enabled in IAM audit configuration. Second, the storage target with CMEK and Bucket Lock must be created. Third, the organization-level aggregated sink must be created, which generates a unique writer identity service account. Fourth, this writer identity must be granted Storage Object Creator permissions on the destination bucket. Finally, Security Command Center Security Health Analytics modules are enabled for ongoing posture monitoring.

Step-by-Step Solution

1
Enable Cloud Storage Data Access Audit Logs in the Organization IAM Audit Config.
Cloud Storage begins generating DATA_READ, DATA_WRITE, and ADMIN_READ log entries across all organizational resources.
Log generation must be configured before telemetry can be captured by logging sinks.
2
Create the destination Cloud Storage bucket with CMEK encryption and a locked retention policy.
A secure, immutable log storage target is available.
The destination bucket must exist prior to sink creation so that the sink path can be validated.
3
Create an organization aggregated log sink targeting the centralized storage bucket.
The log sink is established and outputs a unique writer identity service account.
Aggregated sinks automatically generate a service account that requires explicit destination IAM permissions.
4
Assign the Storage Object Creator role to the sink's writer service account on the destination bucket.
The aggregated sink receives write authorization to write log archives into the storage bucket.
Without explicit IAM permission grants on the destination resource, log ingestion into the bucket will fail.
5
Configure Security Command Center Security Health Analytics to monitor bucket security posture.
Automated posture scanning flags misconfigured or publicly accessible storage buckets.
Completes the security logging and vulnerability detection framework across the Google Cloud organization.

Key Concept

GCP Organization-level aggregated log sink ordering dependencies and security posture auditing
Estimated Time:2m 30s
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic