Google Professional Cloud Security Engineer Question 231
Select 4Google Cloud PlatformYour organization uses multiple Google Cloud APIs for various applications. As a security engineer, you are tasked with ensuring that API usage is continually monitored and access is restricted to prevent misuse or overexposure. Which of the following actions should you take to achieve this goal?
- A
Enable Cloud Audit Logs for all APIs used in your organization.
- B
Use VPC Service Controls to define service perimeters for API access.
- C
Set API-level quotas to restrict excessive usage.
- D
Disable APIs that are not actively used by your project.
- E
Use the Cloud Armor security policy to block unwanted API calls.
Show answer and explanation
Correct answers: A, B, C, D
Explanation
Continually monitoring and restricting API usage requires a combination of logging, access controls, and usage restrictions. Enabling Cloud Audit Logs ensures visibility into API operations, while VPC Service Controls and API quotas provide mechanisms to restrict and control API access. Disabling unused APIs is a best practice to minimize exposure. Using Cloud Armor, however, is not directly relevant to API security but rather to web application protection.
- A. Correct.
Enabling Cloud Audit Logs provides visibility into API activity, allowing you to monitor and detect unauthorized or unusual access patterns. This is a critical step for continual monitoring.
- B. Correct.
VPC Service Controls help restrict API access by creating service perimeters, ensuring that APIs are accessed only from trusted networks and reducing the risk of data exfiltration.
- C. Correct.
Setting API-level quotas prevents excessive usage, helping to mitigate unintended costs and potential abuse.
- D. Correct.
Disabling unused APIs reduces the attack surface, ensuring that only required APIs are exposed to users or applications.
- E. Incorrect.
While Cloud Armor is useful for protecting web applications, it does not directly apply to API management or monitoring, making it an incorrect choice for this specific scenario.