Examkin

Question

Difficulty: MediumSecurity Logging, Audit Logs, and Security Command Center

An enterprise organization wants to automatically detect potential data exfiltration and unauthorized IAM policy modifications in real time across their entire GCP resource hierarchy. They require a fully managed Google Cloud threat detection service that automatically inspects Cloud Audit Logs for suspicious behavior without requiring custom log parsing code or third-party SIEM management. Which GCP solution should the organization implement?

  1. Enable Security Command Center Premium to leverage Event Threat Detection for automated real-time analysis of Cloud Audit Logs across the organization.Answer
  2. B
    Create an organization-level aggregate log sink to Pub/Sub and grant the primitive Owner role to a custom compute engine service account that analyzes logs.
  3. C
    Rely exclusively on fine-grained Identity and Access Management (IAM) role assignments on storage buckets to prevent data exfiltration without perimeter controls or threat detection.
  4. D
    Require Customer-Supplied Encryption Keys (CSEK) across all Cloud Storage buckets to ensure log entries are protected from internal threat actors.

Answer

Enable Security Command Center Premium to leverage Event Threat Detection for automated real-time analysis of Cloud Audit Logs across the organization.
The correct solution uses Security Command Center Premium's built-in Event Threat Detection (ETD) engine. ETD continuously analyzes organization-level Cloud Audit Logs to identify threat patterns—such as unauthorized IAM changes, anomalous data downloads, and compromised service accounts—without requiring custom infrastructure or log parsing software.

Step-by-Step Solution

1
Identify the core architectural requirement.
The solution must detect security threats like data exfiltration and unauthorized IAM changes in real time from audit logs across the GCP resource hierarchy without custom log parsing scripts.
Managed security services minimize operational overhead and avoid custom maintenance.
2
Evaluate Google Cloud native security capabilities.
Security Command Center (SCC) Premium provides Event Threat Detection (ETD), which natively ingests and monitors Cloud Audit Logs (including Admin Activity and Data Access logs) at scale.
ETD uses built-in logic and machine learning to detect suspicious activities such as brute-force attacks, IAM policy tampering, and data exfiltration.
3
Select the option that meets all security and governance constraints.
Enabling Security Command Center Premium with Event Threat Detection fulfills all real-time threat analysis requirements.
It operates across the entire organization hierarchy seamlessly without requiring broad IAM privileges or custom scripts.

Key Concept

Security Command Center Event Threat Detection for automated Cloud Audit Log monitoring
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic