Examkin

Question

Difficulty: HardSecurity Logging, Audit Logs, and Security Command Center

An enterprise operating a multi-folder Google Cloud organization must centralize security operations and satisfy regulatory audit requirements across all current and future projects. The security team requires real-time detection of high-risk threat activity, such as compromised credentials or anomalous data access. Additionally, Data Access audit logs must be preserved for five years in an immutable state, while preventing project-level administrators from modifying retention policies or disabling audit log collection. Which architectural solution fulfills these compliance and security requirements?

  1. Configure an organization-level aggregated log sink with an inclusion filter for Data Access audit logs routing to a Cloud Storage bucket in a dedicated security project with Bucket Lock enabled, and activate Security Command Center Premium at the organization level with Event Threat Detection exporting to Pub/Sub.Answer
  2. B
    Grant primitive Owner roles to project security leads so they can independently configure local Cloud Logging sinks and Security Command Center notification channels according to each project's compliance needs.
  3. C
    Require each project team to manage Data Access audit log storage using Customer-Supplied Encryption Keys (CSEK) and grant project service accounts the Service Account Admin role to authorize log exports across projects.
  4. D
    Deploy VPC Service Controls perimeters around all production folders to prevent unauthorized data movement, relying on default perimeter logs without establishing aggregated log sinks or enabling Security Command Center Premium.

Answer

Configure an organization-level aggregated log sink routing Data Access audit logs to a locked Cloud Storage bucket in a central security project, alongside organization-level Security Command Center Premium with Event Threat Detection.
The solution leveraging an organization-level aggregated log sink combined with Security Command Center Premium is correct. Aggregated sinks at the organization root automatically capture Data Access audit logs across all existing and future projects. Routing these logs to a dedicated security project with Bucket Lock ensures five-year immutable retention immune to project-level administrative overrides. Enabling Security Command Center Premium at the organization level enables Event Threat Detection, which continuously analyzes log streams for security threats and exports alerts via Pub/Sub.

Step-by-Step Solution

1
Evaluate central governance and immutability requirements for audit logging.
Organization-level aggregated log sinks automatically inherit all underlying folders and projects, routing logs to a centralized security project where project-level admins lack permissions.
Prevents project admins from disabling audit logs or tampering with retention policies.
2
Address the five-year immutable retention mandate.
Exporting audit logs to a Cloud Storage bucket configured with Bucket Lock (WORM policy) enforces retention without possibility of premature deletion.
Meets strict compliance and data preservation requirements.
3
Evaluate real-time threat detection requirements across the organization.
Security Command Center Premium enabled at the organization level provides Event Threat Detection (ETD) to continuously scan audit logs for credential misuse and anomaly patterns.
Delivers real-time automated threat identification across all projects.

Key Concept

Organization-Level Security Telemetry and Audit Log Centralization
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic