Examkin

Soru

Zorluk: ZorSecurity Logging, Audit Logs, and Security Command Center

A multinational enterprise operates a multi-folder Google Cloud organization housing sensitive financial microservices. The security compliance team requires immediate notification when service account keys are created outside automated CI/CD pipelines, alongside real-time forwarding of threat findings to an on-premises Security Information and Event Management (SIEM) system. Additionally, security architects must ensure authorized internal operators cannot copy centralized audit logs to unauthorized external Google Cloud storage locations. Which architectural design satisfies these security logging, auditing, and compliance requirements?

  1. Enable Security Command Center Premium with Event Threat Detection, configure continuous findings export via Pub/Sub to the SIEM, and enforce a VPC Service Controls perimeter encompassing the log sinks and storage resources.Cevap
  2. B
    Rely strictly on Cloud IAM role bindings on the log sink Cloud Storage buckets to prevent authorized security analysts from exporting sensitive log files to external projects.
  3. C
    Grant the primitive Owner role across all projects to the automated SIEM integration service account so it can continuously poll Cloud Audit Logs and Security Health Analytics findings.
  4. D
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the SIEM integration connector service account so it can monitor service account activity and key creation across the organization hierarchy.

Cevap

Enable Security Command Center Premium with Event Threat Detection, configure continuous findings export via Pub/Sub to the SIEM, and enforce a VPC Service Controls perimeter encompassing the log sinks and storage resources.
Combining Security Command Center Premium Event Threat Detection with continuous Pub/Sub export satisfies the real-time detection and SIEM integration requirements. Enforcing VPC Service Controls establishes a security perimeter that prevents authorized users from copying audit logs to destination buckets outside the perimeter, mitigating data exfiltration risks.

Adım Adım Çözüm

1
Evaluate real-time threat detection and alerting capabilities.
Security Command Center Premium Event Threat Detection (ETD) analyzes Cloud Audit Logs automatically to identify suspicious activities like unauthorized service account key creation in near real-time.
Standard log queries or manual polling introduce detection latency, whereas SCC ETD natively parses log streams for security threats.
2
Establish real-time forwarding to the external SIEM.
Configure a continuous notification export from Security Command Center to a Pub/Sub topic connected to the on-premises SIEM ingestion pipeline.
Continuous export pushes threat findings immediately without custom API polling overhead.
3
Address data exfiltration risks for security audit logs.
Implement VPC Service Controls around the central audit logging storage resources and projects.
VPC Service Controls restricts ingress and egress of data regardless of IAM permissions, preventing authorized users from copying audit logs to external resources.

Anahtar Kavram

Security Command Center Event Threat Detection and VPC Service Controls Perimeter Protection
Bu soruyu puanla

Konular

Security Logging, Audit Logs, and Security Command Center

Bu konudan daha fazla soru