Google Professional Cloud Security Engineer Question 233
Select 3Google Cloud PlatformYour organization uses multiple Google Cloud APIs in a production environment. As a security engineer, you are tasked with ensuring that only necessary APIs are enabled and that any unusual API activity is detected and addressed quickly. Which of the following steps should you take to achieve this objective?
- A
Use the Cloud Asset Inventory API to list all enabled APIs and identify unused ones.
- B
Enable Cloud Audit Logs for the APIs to monitor their usage and detect anomalies.
- C
Implement custom IAM roles to restrict API access to specific users or groups.
- D
Configure an alerting policy in Cloud Monitoring to notify you of unusual API usage patterns.
- E
Enable the default API monitoring settings in Google Cloud, as they automatically restrict unused APIs.
Show answer and explanation
Correct answers: A, B, D
Explanation
To continually monitor and restrict configured APIs, it is critical to identify and disable unused APIs using tools like Cloud Asset Inventory, monitor usage with Cloud Audit Logs, and configure alerting for unusual activity with Cloud Monitoring. These steps ensure that APIs are actively managed and any suspicious activity is promptly addressed.
- A. Correct.
Using the Cloud Asset Inventory API allows you to list all enabled APIs across your organization and helps identify unused or unnecessary APIs, making it a critical step in restricting configured APIs.
- B. Correct.
Cloud Audit Logs track API usage and provide detailed logs for monitoring access and usage patterns, which is essential for detecting anomalies.
- C. Incorrect.
While custom IAM roles are important for access control, they primarily focus on user permissions rather than monitoring API usage or restricting unused APIs.
- D. Correct.
Cloud Monitoring can be configured to send alerts based on unusual API usage patterns, enabling proactive detection and response to potential security incidents.
- E. Incorrect.
The default API monitoring settings in Google Cloud do not automatically restrict unused APIs. You must manually review and disable them.