Examkin

Soru

Zorluk: OrtaSecurity Logging, Audit Logs, and Security Command Center

A financial enterprise operating multiple Google Cloud projects under an organization resource needs to establish centralized audit logging and threat detection. The compliance team mandates that all Data Access audit logs across the entire organization must be continuously archived to a secure BigQuery dataset in a dedicated security project. Additionally, the security operations team requires real-time detection of anomalous user activities and unauthorized IAM modifications without introducing operational overhead for agent deployment. Which TWO configurations should the cloud architect implement to fulfill these requirements?

  1. Create an organization-level aggregated log sink configured with an inclusion filter for Data Access logs targeting the centralized BigQuery dataset, managed via a dedicated writer service account.Cevap
  2. B
    Grant Owner primitive IAM roles to project administrators across child projects so they can manually create local log sinks targeting the central BigQuery dataset.
  3. Enable Security Command Center Premium to leverage Event Threat Detection for analyzing log streams in real time for suspicious IAM changes and potential threats.Cevap
  4. D
    Configure an organization-wide Cloud Logging exclusion filter to drop all Data Access audit logs before ingestion to reduce storage costs while relying on basic Cloud Monitoring alerts for threat detection.

Cevap

The correct architecture requires creating an organization-level aggregated log sink targeting BigQuery for centralized Data Access audit log retention, and enabling Security Command Center Premium to utilize Event Threat Detection for near real-time analysis of Cloud Audit Logs.
The solution combines organization-level aggregated log sinks for automated, central BigQuery archiving of Data Access audit logs with Security Command Center Premium Event Threat Detection for agentless, real-time threat monitoring across all audit log events.

Adım Adım Çözüm

1
Evaluate central logging requirements for multi-project compliance
Identified that an organization-level aggregated log sink continuously exports logs across all projects under the organization hierarchy to BigQuery.
Centralized aggregated sinks ensure non-repudiable log collection from child projects without depending on individual project administrators.
2
Evaluate threat detection requirements for IAM and anomalous behavior
Identified Security Command Center Premium with Event Threat Detection as the native Google Cloud capability for analyzing audit log streams.
Event Threat Detection inspects Cloud Audit Logs stream data automatically at scale to identify suspicious access and administrative anomalies.

Anahtar Kavram

Organization-level aggregated log sinks and Security Command Center Event Threat Detection
Bu soruyu puanla

Konular

Security Logging, Audit Logs, and Security Command Center

Bu konudan daha fazla soru