Examkin

Soru

Zorluk: Çok zorSecurity Logging, Audit Logs, and Security Command Center

An enterprise operating a multi-folder Google Cloud resource hierarchy needs to stream all Data Access audit logs and Security Command Center (SCC) Premium findings to a third-party SIEM hosted on Google Kubernetes Engine (GKE). The security architecture must adhere to the principle of least privilege and ensure zero log loss. What is the correct sequence of steps to implement this centralized logging and threat export pipeline?

  1. 1Provision a Pub/Sub topic and a dedicated subscription in a centralized Security Operations GCP project to serve as the ingestion buffer for the SIEM.
  2. 2Create an organization-level aggregated log sink with the include-children flag enabled, filtered for Data Access audit logs, and set the destination to the Pub/Sub topic URI.
  3. 3Grant the unique writer identity of the organization log sink the Pub/Sub Publisher (roles/pubsub.publisher) IAM role on the destination Pub/Sub topic.
  4. 4Create an SCC continuous export configuration at the organization level with a filter for high-severity findings, specifying the Pub/Sub topic as the destination.
  5. 5Bind the GKE Workload Identity Kubernetes Service Account to a Google Service Account granted the Pub/Sub Subscriber (roles/pubsub.subscriber) role on the Pub/Sub subscription.

Cevap

The correct operational sequence is: First, provision the Pub/Sub topic and subscription in the central SecOps project. Second, create the organization-level aggregated log sink with include-children enabled. Third, grant the sink's writer identity the Pub/Sub Publisher role on the topic. Fourth, configure the SCC continuous export at the organization level pointing to the Pub/Sub topic. Fifth, bind the GKE Workload Identity service account to the Pub/Sub Subscriber role on the subscription.
Building a centralized security logging pipeline in Google Cloud requires creating target ingestion infrastructure (Pub/Sub topic/subscription) before referencing it in log sinks or SCC exports. Once the aggregated sink is created with `--include-children`, GCP generates a service account (writer identity) that must be explicitly granted `roles/pubsub.publisher` on the topic. After establishing log flow authorization, SCC continuous export is configured. Finally, the consumer SIEM workload on GKE is authorized using Workload Identity with `roles/pubsub.subscriber` on the subscription.

Adım Adım Çözüm

1
Provision Pub/Sub Topic and Subscription
Destinations are created and ready to receive streaming logs and findings.
Log sinks and continuous exports require an existing target resource URI during creation validation.
2
Create Organization-Level Aggregated Log Sink
Aggregated log sink is instantiated across all folders/projects and generates a unique writer identity service account.
Creating the sink defines the filter rules and generates the service account identity needed for IAM authorization.
3
Authorize Log Sink Writer Identity
Writer identity is granted `roles/pubsub.publisher` on the destination Pub/Sub topic.
Google Cloud log sinks do not automatically receive write access to destination resources across project boundaries.
4
Configure SCC Continuous Export
Security Command Center streams real-time threat findings to the Pub/Sub topic.
Continuous export streams findings as they occur once the target Pub/Sub topic infrastructure is established.
5
Grant Subscriber Permissions via Workload Identity
SIEM workload on GKE securely pulls audit logs and findings using Workload Identity.
Adheres to least privilege security requirements for application ingestion without managing exported service account keys.

Anahtar Kavram

Organization-level log aggregation, service account authorization for log sinks, Security Command Center continuous export, and GKE Workload Identity integration.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Security Logging, Audit Logs, and Security Command Center

Bu konudan daha fazla soru