A security analyst must investigate object access patterns on a sensitive Google Cloud Storage bucket. Place the steps required to grant necessary access, configure audit logging, generate test events, and analyze the resulting logs in the correct sequential order.
- 1Grant the security analyst the Private Logs Viewer (roles/logging.privateLogViewer) role on the project.
- 2Configure the project's Audit Logs policy in IAM & Admin to enable 'Data Read' Data Access audit logs for the Cloud Storage service.
- 3Perform a read operation on objects within the target Cloud Storage bucket.
- 4Execute a `gcloud logging read` command filtering for logName matching 'cloudaudit.googleapis.com/data_access' and the target bucket resource.
Cevap
The correct sequence is: 1) Grant the Private Logs Viewer role to the analyst, 2) Enable 'Data Read' Data Access audit logs for Cloud Storage under IAM & Admin Audit Logs, 3) Perform a read operation on the target bucket objects, 4) Execute the `gcloud logging read` command filtering for the data_access logName and bucket resource.
The workflow follows a logical security lifecycle: first establish least privilege permissions (Private Logs Viewer role), second activate the audit logging policy for Cloud Storage Data Read actions, third generate sample traffic by reading bucket objects, and finally retrieve the resulting Data Access audit log entries using gcloud CLI.
Adım Adım Çözüm
Anahtar Kavram
Viewing and Analyzing Cloud Audit Logs
Tahmini Süre:1m 30s