Google Professional Cloud Security Engineer Question 409
Select 3Google Cloud PlatformYour organization is using Google Cloud and wants to ensure that all projects comply with security best practices at scale. You have been asked to implement a solution that prevents policy drift, identifies security misconfigurations, and enforces organization-wide policies across all projects. Which of the following approaches should you use?
- A
Leverage Security Health Analytics custom modules to create organization-specific security rules and detect misconfigurations.
- B
Use Google Cloud Organization Policies to enforce constraints such as disabling external IPs for virtual machines.
- C
Manually review IAM roles and permissions in each project to ensure compliance.
- D
Implement a Cloud Security Posture Management (CSPM) tool to monitor and report policy violations across the organization.
- E
Deploy a firewall rule in each project to block all incoming traffic by default.
Show answer and explanation
Correct answers: A, B, D
Explanation
To manage policy and drift detection at scale, you need a combination of automated tools and organization-wide configurations. Security Health Analytics custom modules and CSPM tools help monitor and detect misconfigurations, while Organization Policies enforce consistent security settings. Manual processes or isolated configurations, such as project-level firewall rules, are not scalable or sufficient for enterprise-level policy management.
- A. Correct.
Security Health Analytics custom modules allow you to define custom security rules tailored to your organization's needs, helping to detect and report misconfigurations.
- B. Correct.
Google Cloud Organization Policies enforce constraints at the organization or folder level, ensuring consistent security configurations and preventing policy drift.
- C. Incorrect.
Manually reviewing IAM roles and permissions is error-prone and does not scale well across many projects or organizations.
- D. Correct.
Cloud Security Posture Management (CSPM) tools provide centralized monitoring and reporting on compliance and security misconfigurations, aiding in policy enforcement at scale.
- E. Incorrect.
Deploying a firewall rule in each project to block traffic is not a comprehensive approach to managing policy or drift detection and does not address compliance monitoring.