Examkin

Soru

Zorluk: ZorSecurity Logging, Audit Logs, and Security Command Center

A financial analytics organization manages sensitive data across a multi-folder Google Cloud resource hierarchy. The chief information security officer requires aggregating all Data Access and Admin Activity audit logs across all current and future folders into a centralized log repository. Additionally, the security design must prevent insider threats where project administrators with high-privilege project permissions could copy or exfiltrate centralized audit records to an external, unapproved storage location. Which architectural strategy fulfills all security and compliance requirements?

  1. Define an organization-level aggregated Cloud Logging sink destination to a Cloud Storage bucket in a dedicated security project, and enclose both the source projects and the logging storage project inside a VPC Service Controls security perimeter.Cevap
  2. B
    Define an organization-level aggregated Cloud Logging sink destination to a Cloud Storage bucket, and rely strictly on IAM policy bindings by revoking storage object creation permissions from project administrators while leaving network egress open.
  3. C
    Grant the primitive Owner role at the organization root to the log sink service account, relying on resource hierarchy inheritance to manage destination bucket permissions across all child folders.
  4. D
    Grant project administrators the Service Account Admin role on the aggregated log sink service account so they can re-authenticate log export writers directly within their projects.

Cevap

Define an organization-level aggregated Cloud Logging sink destination to a Cloud Storage bucket in a dedicated security project, and enclose both the source projects and the logging storage project inside a VPC Service Controls security perimeter.
Combining an organization-level aggregated Cloud Logging sink with VPC Service Controls provides a comprehensive compliance and security architecture. The aggregated sink ensures continuous collection of all audit logs across current and future projects under the organization hierarchy. Enclosing the storage bucket and source projects within a VPC Service Controls perimeter isolates the API access layer, ensuring that even users with broad project IAM rights cannot exfiltrate log files to external Cloud Storage buckets located outside the secure perimeter.

Adım Adım Çözüm

1
Configure Organization Aggregated Log Sink
Aggregates Admin Activity and Data Access audit logs automatically from all current and future projects into a dedicated centralized project destination.
Ensures complete coverage across the organizational hierarchy without manual project-by-project setup.
2
Implement VPC Service Controls Security Perimeter
Forms a boundary around Cloud Storage services containing audit logs and source project resources.
IAM permissions alone cannot prevent data exfiltration. VPC Service Controls blocks unauthorized API data movement across boundary limits, even for privileged identities.
3
Validate Least Privilege Service Account Access
Ensures log sink writer identity is only granted the necessary Storage Object Creator role on the destination bucket.
Follows security best practices by avoiding primitive IAM roles or broad administrative grants.

Anahtar Kavram

Centralized Organization Security Logging and VPC Service Controls Perimeter Data Exfiltration Prevention
Bu soruyu puanla

Konular

Security Logging, Audit Logs, and Security Command Center

Bu konudan daha fazla soru