Google Professional Cloud Security Engineer Question 406
Select 3Google Cloud PlatformYour organization is managing multiple Google Cloud projects and wants to ensure consistent security policies across all projects, while also detecting configuration drift and policy violations at scale. As a Professional Cloud Security Engineer, how can you achieve this effectively?
- A
Use Organization Policies to enforce security constraints at the organization or folder level.
- B
Implement Cloud Security Command Center (SCC) and enable Security Health Analytics to monitor and detect configuration drift.
- C
Manually review all projects periodically to ensure compliance with security policies.
- D
Develop custom modules for Security Health Analytics to identify unique security risks specific to your organization.
- E
Utilize Deployment Manager to enforce security policies across projects.
Show answer and explanation
Correct answers: A, B, D
Explanation
To manage policy and drift detection at scale, you should use tools and methods designed for centralized management and automated monitoring. Organization Policies enforce security constraints consistently across projects, while Cloud Security Command Center with Security Health Analytics provides automated drift and violation detection. Developing custom modules for Security Health Analytics allows you to extend its capabilities to meet unique security requirements. Manual reviews and tools like Deployment Manager are not practical or suitable for this use case.
- A. Correct.
Organization Policies provide a centralized way to enforce consistent security constraints across the entire organization or specific folders, making it effective for managing security policies at scale.
- B. Correct.
Cloud Security Command Center (SCC) with Security Health Analytics enables automated monitoring and detection of configuration drift and policy violations, reducing manual effort and enhancing scalability.
- C. Incorrect.
Manually reviewing all projects is not scalable and prone to human error. This is not an effective method for managing security policies or detecting drift at scale.
- D. Correct.
Developing custom modules for Security Health Analytics allows organizations to tailor the detection of security risks to their specific needs, improving the relevance of the monitoring.
- E. Incorrect.
Deployment Manager is primarily used for managing infrastructure as code and does not directly address policy enforcement or drift detection at scale.