Examkin

Soru

Zorluk: OrtaSecurity Logging, Audit Logs, and Security Command Center

An enterprise organization requires centralized compliance logging across all existing and future Google Cloud projects. The security architecture must capture both Admin Activity and Data Access audit logs, ensure that project-level administrators cannot disable or modify log export configurations, and adhere to governance requirements by protecting the centralized storage bucket with keys managed in Cloud KMS. Which strategy should the cloud security architect implement?

  1. Configure an organization-aggregated log sink in Cloud Logging that captures Admin Activity and Data Access logs, route the sink to a centralized Cloud Storage log bucket, and encrypt the destination bucket using Customer-Managed Encryption Keys (CMEK) hosted in Cloud KMS.Cevap
  2. B
    Assign the primitive Owner role to security operations team members across all projects so they can manually configure project-level log sinks to a central bucket encrypted with Customer-Supplied Encryption Keys (CSEK).
  3. C
    Rely exclusively on project-level IAM policies to restrict log deletion, avoiding organization sinks, and mandate Customer-Supplied Encryption Keys (CSEK) for log bucket storage.
  4. D
    Establish project-specific Cloud Audit Log exports into local project buckets and rely on project IAM roles alone to prevent data exfiltration without configuring security perimeters or aggregated sinks.

Cevap

Configure an organization-aggregated log sink in Cloud Logging targeting a centralized Cloud Storage bucket encrypted with Customer-Managed Encryption Keys (CMEK) in Cloud KMS.
The correct strategy leverages organization-aggregated log sinks in Cloud Logging combined with CMEK via Cloud KMS. Organization sinks inherit down the resource hierarchy, ensuring project administrators cannot tamper with log export rules. CMEK satisfies key management governance requirements without the operational burden of managing raw key material.

Adım Adım Çözüm

1
Enforce centralized log ingestion across the resource hierarchy.
Creating an aggregated log sink at the organization level automatically includes audit logs from all current and future descendant projects.
Prevents project administrators from modifying or disabling audit log collection.
2
Enable required audit log types.
Ensure Data Access and Admin Activity audit logs are included in the aggregated sink filter.
Meets compliance auditing requirements for both management operations and sensitive data reads/writes.
3
Apply Customer-Managed Encryption Keys (CMEK) to the central storage bucket.
Log data at rest is encrypted using keys managed via Cloud KMS.
Satisfies corporate governance while delegating cryptographic key lifecycle management to Cloud KMS rather than managing raw key material on-premises.

Anahtar Kavram

Organization-aggregated log sinks provide tamper-resistant, centralized security log aggregation across Google Cloud hierarchies when paired with Cloud KMS CMEK.
Bu soruyu puanla

Konular

Security Logging, Audit Logs, and Security Command Center

Bu konudan daha fazla soru