Google Professional Cloud Security Engineer Question 232
Select 4Google Cloud PlatformYour organization uses multiple Google Cloud services and has exposed several APIs for internal and external access. As a Professional Cloud Security Engineer, you need to ensure that API usage is continually monitored and restricted to prevent unauthorized access and misuse. Which of the following actions should you take to effectively monitor and restrict API usage?
- A
Enable Cloud Audit Logs for all services and regularly review logs for unusual activity.
- B
Use Google Cloud's API Gateway to enforce authentication and authorization policies for APIs.
- C
Set up Service Accounts with minimal permissions and use them to authenticate API calls.
- D
Disable all APIs by default and enable them only when specifically required by a service or application.
- E
Implement Cloud Armor to restrict API access based on IP ranges and geolocation.
Show answer and explanation
Correct answers: A, B, C, D
Explanation
To monitor and restrict API access effectively, you should use a combination of strategies including logging, access control, and minimal exposure. Enabling Cloud Audit Logs helps in tracking API usage and identifying anomalies. API Gateway enables centralized management of authentication and authorization policies for APIs. Using Service Accounts ensures secure and restricted access, while disabling unnecessary APIs reduces the overall risk. Cloud Armor, while useful for protecting web applications, is not the best fit for API-specific security measures in this context.
- A. Correct.
Enabling Cloud Audit Logs allows you to track API usage and detect unusual or unauthorized activity, making it a critical step in monitoring APIs.
- B. Correct.
API Gateway provides features like authentication, authorization, and traffic management, which are essential for securing and restricting access to APIs.
- C. Correct.
Using Service Accounts with minimal permissions ensures that API calls are authenticated and adhere to the principle of least privilege, reducing potential misuse.
- D. Correct.
Disabling APIs by default and enabling them only when necessary minimizes the attack surface and ensures only required APIs are exposed.
- E. Incorrect.
While Cloud Armor is effective for protecting web applications, it is not primarily designed for API-specific restrictions like authentication and authorization, making it less relevant in this scenario.