Examkin

Question

Difficulty: Very hardSecurity Logging, Audit Logs, and Security Command Center

A financial enterprise operating on Google Cloud requires an automated central compliance solution for security audit logs. The security architect must aggregate Data Access audit logs across all organization folders into a dedicated security project. The solution must satisfy strict regulatory compliance by protecting log destination buckets with enterprise-managed encryption keys, preventing authorized internal identities from exfiltrating stored log files to unauthorized external projects, and granting minimum required identity permissions. Which architecture strategy meets these security and compliance requirements?

  1. Configure an organization-level aggregated log sink targeting a central Cloud Storage bucket encrypted with Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and include the central security logging project within a VPC Service Controls perimeter.Answer
  2. B
    Configure an organization-level aggregated log sink targeting a central Cloud Storage bucket encrypted with Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and rely strictly on IAM roles and storage bucket ACLs to prevent authorized users from exfiltrating log data.
  3. C
    Configure an organization-level aggregated log sink targeting a central Cloud Storage bucket encrypted with Customer-Supplied Encryption Keys (CSEK) managed on-premises, and place the logging project within a VPC Service Controls perimeter.
  4. D
    Configure an organization-level aggregated log sink targeting a central Cloud Storage bucket encrypted with Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the sink identity inside a VPC Service Controls perimeter.

Answer

The correct strategy is to create an organization-level aggregated log sink directing logs to a Cloud Storage bucket encrypted with Customer-Managed Encryption Keys (CMEK) via Cloud KMS, while enforcing a VPC Service Controls perimeter around the central logging project.
The valid architecture combines organization-level aggregated logging for complete visibility, Customer-Managed Encryption Keys (CMEK) via Cloud KMS to fulfill customer-managed key governance, and VPC Service Controls around the central logging project to strictly block data exfiltration to external, non-authorized GCP projects.

Step-by-Step Solution

1
Evaluate key management options for automated log sinks.
Determine that Google Cloud services writing background audit logs automatically support Cloud KMS Customer-Managed Encryption Keys (CMEK), whereas Customer-Supplied Encryption Keys (CSEK) cannot be used because automated service agents cannot supply raw keys per API request.
Regulatory compliance requiring customer control over encryption keys must be satisfied via CMEK when integrating with automated Cloud Logging export sinks.
2
Assess data exfiltration protections for audit logs.
Recognize that IAM policies authenticate and authorize identities but cannot prevent an authorized user or compromised service account from exfiltrating data to an outside storage bucket.
VPC Service Controls must be configured around the security logging project to establish a security perimeter that restricts cross-project data transfers.
3
Verify least privilege identity configuration.
Ensure service accounts writing audit logs are assigned specific resource object roles (such as Storage Object Creator) rather than elevated administrative roles.
Excessive administrative privileges like Service Account Admin increase attack surface and violate GCP security standards.

Key Concept

Organization Log Aggregation, CMEK Integration, and Data Exfiltration Prevention via VPC Service Controls
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic