Google Professional Cloud Security Engineer Question 230
Select 4Google Cloud PlatformYour organization uses multiple Google Cloud APIs to manage resources across projects. To reduce the risk of unauthorized access or excessive permissions, you are tasked with implementing best practices for continually monitoring and restricting configured APIs. Which actions should you take to meet this requirement?
- A
Enable the Cloud Asset Inventory API to review and monitor API usage across projects.
- B
Use VPC Service Controls to create service perimeters around sensitive APIs.
- C
Disable unused APIs in the Google Cloud Console to reduce the attack surface.
- D
Assign the Owner role to all users to ensure they have full access and can troubleshoot issues.
- E
Use the API Gateway to define and enforce custom API usage policies.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To effectively monitor and restrict configured APIs, it's essential to use tools like Cloud Asset Inventory for visibility, VPC Service Controls to secure access, and API Gateway to enforce policies. Additionally, disabling unused APIs reduces potential vulnerabilities. Assigning excessive permissions, such as the Owner role, should be avoided as it contradicts security best practices.
- A. Correct.
The Cloud Asset Inventory API allows you to gain visibility into API usage and configurations across your projects, which is essential for monitoring.
- B. Correct.
VPC Service Controls provide a way to restrict access to sensitive APIs by creating service perimeters, enhancing security for critical resources.
- C. Correct.
Disabling unused APIs reduces the attack surface and mitigates potential vulnerabilities in unused services.
- D. Incorrect.
Assigning the Owner role to all users violates the principle of least privilege and increases the risk of accidental or malicious changes to API configurations.
- E. Correct.
The API Gateway allows you to define and enforce custom API usage policies, such as rate limiting or authentication, helping to restrict API access effectively.