Examkin

Soru

Zorluk: Çok zorSecurity Logging, Audit Logs, and Security Command Center

A multinational financial services company operating on Google Cloud needs to implement automated threat detection and immediate remediation for misconfigured resources (such as publicly exposed storage buckets or anomalous service account key creation) across hundreds of projects. Additionally, compliance requirements mandate that all Admin Activity and Data Access audit logs must be immutable and centralized in a manner that prevents project-level resource administrators from modifying or deleting their own project audit records. Which architecture strategy best satisfies these operational and security compliance requirements?

  1. Enable Security Command Center Premium findings notifications routed to an organization-wide Cloud Pub/Sub topic linked to automated Cloud Functions remediation workflows, and configure an organization-level aggregated log sink exporting audit logs to a Cloud Storage bucket protected by a Locked Retention Policy in a dedicated, isolated log-governance project.Cevap
  2. B
    Grant the primitive Owner role (roles/owner) to security administrators across all project folders, and configure project-level Cloud Logging sinks to export audit logs to local Pub/Sub topics monitored manually by operational engineers.
  3. C
    Require Customer-Supplied Encryption Keys (CSEK) to manually encrypt all audit logs and Security Command Center event notifications prior to exporting them via Pub/Sub to external security information and event management (SIEM) systems.
  4. D
    Grant the automated remediation Cloud Function service account the Service Account Admin role (roles/iam.serviceAccountAdmin) across the organization hierarchy so it can reconfigure audit log sink destinations and service account key policies when threats are detected.

Cevap

Enable Security Command Center Premium findings notifications routed to an organization-wide Cloud Pub/Sub topic linked to automated Cloud Functions remediation workflows, and configure an organization-level aggregated log sink exporting audit logs to a Cloud Storage bucket protected by a Locked Retention Policy in a dedicated, isolated log-governance project.
The correct strategy leverages Security Command Center Premium to generate continuous threat findings and exports them via Pub/Sub notifications to trigger automated Cloud Functions remediation. Concurrently, centralization and compliance immutability are guaranteed by configuring an Organization Aggregated Log Sink that routes Admin Activity and Data Access audit logs into a dedicated security project with Cloud Storage Bucket Lock enabled, ensuring project-level administrators cannot modify or delete audit trails.

Adım Adım Çözüm

1
Evaluate real-time threat detection and automated remediation requirements across multi-project environments.
Identify Security Command Center (SCC) Premium notification configs combined with Pub/Sub and Cloud Functions / Cloud Run as the standard pattern for automated security incident response.
SCC provides centralized asset vulnerability and threat detection, and publishing findings to Pub/Sub enables event-driven remediation pipelines.
2
Evaluate log centralization and immutability requirements.
Implement an Organization Aggregated Sink at the GCP Organization level to capture all project audit logs into a dedicated security project.
Organization-level sinks prevent project-level admins from disabling log sinks or deleting logs in their local projects.
3
Ensure log storage meets strict immutability and compliance regulations.
Apply a Retention Policy with Bucket Lock (Object Lock) to the target Cloud Storage bucket in the central logging project.
Bucket Lock enforces write-once-read-many (WORM) compliance, preventing deletion or alteration of audit logs even by project owners.

Anahtar Kavram

Centralized security auditing and event-driven automated remediation using Organization Aggregated Sinks, Bucket Lock, and Security Command Center notifications.
Bu soruyu puanla

Konular

Security Logging, Audit Logs, and Security Command Center

Bu konudan daha fazla soru