Examkin

Soru

Zorluk: OrtaSecurity Logging, Audit Logs, and Security Command Center

A enterprise healthcare company operating on Google Cloud needs to establish a centralized security auditing and log monitoring architecture across all projects under its organization. The compliance policy mandates that all read and write operations on sensitive patient data stored in Cloud Storage must be logged and monitored for suspicious activity, while maintaining strict adherence to the principle of least privilege. Which TWO architectural recommendations should a Cloud Architect make to fulfill these requirements?

  1. Enable Data Access audit logs (DATA_READ and DATA_WRITE) for Cloud Storage at the GCP Organization resource level.Cevap
  2. B
    Grant the primitive Owner role (roles/owner) to the centralized Security Operations Center service account to ensure unrestricted read access across all logs and Security Command Center findings.
  3. Configure an organization-level aggregated log sink to route audit logs to a centralized Pub/Sub topic or BigQuery dataset.Cevap
  4. D
    Rely exclusively on IAM roles and Data Access audit logging to prevent authorized internal users from exfiltrating stored log data to external Cloud Storage buckets.

Cevap

The Cloud Architect should recommend enabling Data Access audit logs (DATA_READ and DATA_WRITE) for Cloud Storage at the organization level and configuring an organization-level aggregated log sink to route audit logs to a centralized BigQuery dataset or Pub/Sub topic.
Enabling Data Access audit logs (DATA_READ and DATA_WRITE) for Cloud Storage at the organization level ensures that read and write operations on storage buckets across all projects are captured, as Data Access logs are not active by default for Cloud Storage. Additionally, setting up an organization-level aggregated log sink allows seamless collection and centralization of audit log entries into BigQuery or Pub/Sub for automated threat detection and compliance analysis.

Adım Adım Çözüm

1
Identify missing audit log telemetry for data operations
Determine that Cloud Storage Data Access audit logs must be explicitly enabled at the organization level because they are disabled by default.
Default GCP Audit Logging only collects Admin Activity and System Event logs.
2
Establish centralized log aggregation
Create an organization-wide aggregated log sink targeting a central Pub/Sub topic or BigQuery log repository.
Aggregated sinks automatically inherit logging across all present and future project resources.
3
Evaluate least-privilege permissions and perimeter controls
Reject primitive IAM role assignments and avoid relying solely on IAM for data exfiltration defense.
Least privilege requires fine-grained roles, while VPC Service Controls are necessary to prevent exfiltration by legitimate accounts.

Anahtar Kavram

Centralized Security Audit Logging and Data Access Control
Bu soruyu puanla

Konular

Security Logging, Audit Logs, and Security Command Center

Bu konudan daha fazla soru