Examkin

Soru

Zorluk: ZorSecurity Logging, Audit Logs, and Security Command Center

An enterprise organization operates a multi-folder Google Cloud resource hierarchy containing hundreds of projects. The Security Operations Center (SOC) requires a real-time audit logging solution to capture all Data Access audit logs across all projects and stream them securely to an external Security Information and Event Management (SIEM) system. Additionally, the Chief Information Security Officer (CISO) mandates strict data exfiltration protections so that insider threats cannot copy audit log streams to unauthorized external locations outside the organization. Which TWO architectural actions should the Cloud Architect combine to satisfy these security and operational requirements?

  1. Configure an aggregated organization-level Cloud Logging sink that filters for Data Access audit logs and routes them to a central Cloud Pub/Sub topic hosted in a dedicated security administration project.Cevap
  2. B
    Rely exclusively on fine-grained IAM permissions across the resource hierarchy to restrict user access and prevent security analysts from copying log data to external storage locations.
  3. Enforce a VPC Service Controls perimeter around the security administration project containing the log ingestion Pub/Sub topic and processing infrastructure to prevent data exfiltration outside the trust boundary.Cevap
  4. D
    Grant the primitive Owner role at the organization node to the service account used by the log ingestion pipeline to grant full access to log buckets and Pub/Sub topics across all projects.

Cevap

The correct architecture combines an aggregated organization-level log sink routing Data Access logs to a central Pub/Sub topic with a VPC Service Controls perimeter wrapping the security administration project.
The solution requires a combination of real-time multi-project log aggregation and strict perimeter protection. An aggregated organization-level log sink filtering for Data Access logs and streaming to a central Pub/Sub topic satisfies the real-time SIEM integration requirement across all projects. Concurrently, placing the logging project inside a VPC Service Controls perimeter blocks unauthorized egress and mitigates data exfiltration risks.

Adım Adım Çözüm

1
Centralize log aggregation across the resource hierarchy
Creating an aggregated sink at the organization root with inclusion filters for Data Access audit logs ensures complete coverage across all child folders and projects into a centralized Pub/Sub topic.
Individual project sinks are operational anti-patterns for enterprise governance and fail to guarantee unified coverage across newly created projects.
2
Implement perimeter security against data exfiltration
Enclosing the central logging ingestion project inside a VPC Service Controls perimeter restricts API requests to authorized networks and prevents copying log entries to external GCP projects or public destinations.
IAM authorization alone does not prevent users with valid permissions from writing or copying data to external buckets outside the corporate control boundary.
3
Apply least privilege access management
Configure service account permissions using minimal predefined roles rather than primitive roles.
Primitive roles like Owner grant excessive administrative capabilities and increase the blast radius of potential key compromise.

Anahtar Kavram

Centralized Audit Log Aggregation and VPC Service Controls Perimeter Protection
Bu soruyu puanla

Konular

Security Logging, Audit Logs, and Security Command Center

Bu konudan daha fazla soru