Google Professional Cloud Security Engineer Question 228
Select 3Google Cloud PlatformYour company uses multiple Google Cloud APIs for various services. As a Professional Cloud Security Engineer, you need to ensure that unused APIs are disabled to reduce the attack surface. Additionally, you need to monitor active API usage continuously to detect any unusual activity. Which of the following actions should you take to meet these requirements?
- A
Use the Service Usage API to list and disable unused APIs.
- B
Enable Cloud Audit Logs to track API activity and detect unusual patterns.
- C
Use Cloud Identity and Access Management (IAM) to block API access for all users by default.
- D
Set up alerts in Cloud Monitoring to notify you about abnormal API usage.
- E
Configure Cloud Armor to restrict API access based on IP addresses.
Show answer and explanation
Correct answers: A, B, D
Explanation
To continually monitor and restrict API usage, you need to disable unused APIs using the Service Usage API, track API activity using Cloud Audit Logs, and set up alerts in Cloud Monitoring for proactive detection of abnormal usage. These actions ensure that only necessary APIs are enabled and their usage is closely monitored, reducing potential security risks.
- A. Correct.
The Service Usage API allows you to list enabled APIs and disable any that are not required, minimizing the attack surface.
- B. Correct.
Cloud Audit Logs provide a detailed record of API usage, helping to identify and investigate unusual patterns or unauthorized activities.
- C. Incorrect.
While IAM is critical for managing permissions, blocking API access for all users by default would unnecessarily disrupt service functionality rather than monitor or restrict specific APIs.
- D. Correct.
Cloud Monitoring allows you to set up custom alerts to notify you when API usage deviates from expected patterns, enabling proactive monitoring.
- E. Incorrect.
Cloud Armor is designed to protect applications from external threats, such as DDoS attacks, but it is not specifically used for monitoring or managing API configurations directly.