Google Professional Cloud Security Engineer Question 408
Single answerGoogle Cloud PlatformYour organization manages multiple projects and uses Google Cloud Platform (GCP) at scale. You have been tasked with ensuring compliance with your organization's security policies and detecting configuration drift across all projects. Additionally, you need to enforce custom organization policies and monitor for any violations. Which approach should you take to achieve this?
- A
Use Cloud Security Command Center (SCC) to create custom modules for Security Health Analytics and apply them across the organization.
- B
Rely on manual audits of project configurations and use Cloud IAM to enforce policies where necessary.
- C
Use Cloud Deployment Manager to define configurations and enforce organization policies on a per-project basis.
- D
Create custom organization policies using the Organization Policy Service and combine it with a Cloud Security Posture Management (CSPM) tool to detect and manage drift.
Show answer and explanation
Correct answer: D
Explanation
To manage policy and drift detection at scale in Google Cloud, the best approach is to leverage the Organization Policy Service for creating and enforcing custom organization policies and use a Cloud Security Posture Management (CSPM) tool to monitor and detect configuration drift. This combination provides both enforcement and visibility across all projects, ensuring compliance with security standards.
- A. Incorrect.
This is correct because Cloud Security Command Center (SCC) allows you to create custom modules for Security Health Analytics, which can help with monitoring and detecting security misconfigurations, but it does not handle custom organization policies or enforce drift management comprehensively.
- B. Incorrect.
This is incorrect because manual audits are not scalable for large organizations. While Cloud IAM can enforce access policies, it does not provide drift detection or custom policy enforcement.
- C. Incorrect.
This is incorrect because Cloud Deployment Manager primarily focuses on infrastructure deployment and management, but it does not provide the capability to enforce organization-wide policies or detect drift effectively.
- D. Correct.
This is correct because the Organization Policy Service allows the creation of custom policies to enforce compliance, while a Cloud Security Posture Management (CSPM) tool can monitor for misconfigurations and detect drift across projects. Combining both ensures scalable policy enforcement and drift detection.