Examkin

Question

Difficulty: Very hardSecurity Logging, Audit Logs, and Security Command Center

An enterprise organization with hundreds of Google Cloud projects structured under a multi-folder hierarchy needs to establish a centralized security auditing and threat monitoring architecture. The lead cloud security architect must satisfy three strict requirements:
1. Capture all audit logs (including Data Access audit logs) across all current and future projects and streaming export them to a third-party SIEM running outside Google Cloud.
2. Prevent unauthorized exfiltration of aggregated audit log data by compromised internal identities possessing storage read permissions.
3. Enable real-time detection of threat patterns across the organization hierarchy while adhering to the principle of least privilege for security operations teams.

Which TWO architectural configurations must the security team implement to satisfy these requirements? (Select TWO.)

  1. Create an organization-aggregated log sink with an empty inclusion filter targeting a Pub/Sub topic in a dedicated security project enclosed within a VPC Service Controls security perimeter.Answer
  2. B
    Grant the primitive Owner role (roles/owner) at the organization level to the security operations service account to ensure uninterrupted access across all logging and monitoring endpoints.
  3. Enable Event Threat Detection in Security Command Center at the organization level and grant security operators dedicated fine-grained roles such as Security Center Admin Viewer (roles/securitycenter.adminViewer).Answer
  4. D
    Rely exclusively on Cloud IAM bucket-level permissions and IAM Conditions on the log destination Cloud Storage buckets to restrict log exfiltration to unauthorized accounts.

Answer

The correct architectural choices are: (1) Creating an organization-aggregated log sink targeting a Pub/Sub topic inside a dedicated logging project protected by a VPC Service Controls perimeter, and (2) Enabling Event Threat Detection within Security Command Center at the organization level while assigning fine-grained security roles.
The correct options combined provide a complete enterprise security solution. Creating an organization-aggregated log sink with an empty inclusion filter routes all log streams (including Data Access logs) from all current and future projects to a Pub/Sub topic. Placing this topic inside a dedicated project enclosed by a VPC Service Controls perimeter guarantees protection against data exfiltration. Furthermore, enabling Event Threat Detection in Security Command Center Premium/Enterprise at the organization level provides automated real-time threat monitoring, while granting fine-grained security roles ensures strict adherence to least-privilege IAM principles.

Step-by-Step Solution

1
Evaluate centralized audit logging and scope requirements across the organization hierarchy.
An organization-aggregated log sink ensures all present and future projects inherit logging policies and stream audit logs centrally without project-by-project manual setup.
Organization-level aggregation is required to enforce baseline compliance and capture Data Access logs uniformly across child folders and projects.
2
Analyze threat detection and data exfiltration defense mechanisms.
VPC Service Controls boundaries prevent authorized or compromised identities from transferring centralized audit data out of the organization perimeter to external destinations.
IAM rules dictate identity access control, but VPC Service Controls are strictly required to define network-level perimeter guardrails against data exfiltration.
3
Configure Security Command Center threat monitoring with fine-grained access control.
Event Threat Detection in Security Command Center analyzes log streams in real time across the organization resource, while assigning specific roles like roles/securitycenter.adminViewer preserves least-privilege security posture.
Using specialized Security Command Center roles avoids assigning dangerous primitive roles while maintaining complete visibility into security findings.

Key Concept

Centralized Organization Log Sinks, Event Threat Detection, VPC Service Controls, and Least-Privilege IAM
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic