Google Professional Cloud Security Engineer Question 407
Select 3Google Cloud PlatformYour organization uses Google Cloud to host multiple projects across various teams. To enhance cloud security posture management, you want to ensure that all projects comply with company policies, such as requiring encryption for Cloud Storage buckets and restricting public IP addresses on VM instances. You also need to detect and remediate policy drift automatically. Which combination of actions should you take to meet these requirements?
- A
Use Security Health Analytics to create custom modules for detecting non-compliant resources.
- B
Set up Organization Policies to enforce restrictions on public IP addresses and require encryption for Cloud Storage buckets.
- C
Use Forseti or Config Validator to automatically audit policy compliance across projects.
- D
Deploy Google Cloud Armor to restrict unauthorized access to resources at the network level.
- E
Enable a Security Command Center Premium subscription to automate policy drift detection and remediation.
Show answer and explanation
Correct answers: A, B, E
Explanation
To manage policy compliance and detect drift at scale, you need to combine tools that enforce policies (e.g., Organization Policies), detect misconfigurations (e.g., Security Health Analytics), and provide automated drift detection and remediation (e.g., Security Command Center Premium). This ensures that all projects remain compliant with company security requirements while addressing any deviations proactively.
- A. Correct.
Correct: Security Health Analytics allows you to create custom modules to identify misconfigurations and non-compliance issues, which is essential for detecting drift.
- B. Correct.
Correct: Organization Policies enforce governance rules, such as disallowing public IPs or mandating Cloud Storage bucket encryption, ensuring compliance at the project level.
- C. Incorrect.
Incorrect: While Forseti and Config Validator are useful for auditing, they do not automatically remediate policy drift, which is a key requirement in this scenario.
- D. Incorrect.
Incorrect: Google Cloud Armor is a tool for protecting web applications from threats, not for managing policy compliance or detecting drift.
- E. Correct.
Correct: Security Command Center Premium includes features for detecting and remediating policy drift, helping maintain compliance across projects.