Google Professional Cloud Security Engineer Question 410
Select 2Google Cloud PlatformYour organization is managing a multi-project environment in Google Cloud. To ensure compliance and security standards, you need to implement policy enforcement and continuously detect configuration drift across all projects. The solution should allow you to define custom policies specific to your organization’s requirements and integrate these policies into Security Health Analytics for proactive monitoring. Which of the following actions should you take?
- A
Define custom organization policies using the Google Cloud Console and enforce them through the Resource Manager API.
- B
Use Config Validator to create custom constraint templates and integrate them into Security Health Analytics.
- C
Enable Security Health Analytics in Security Command Center and configure custom modules for policy compliance checks.
- D
Deploy Forseti Security to automate the enforcement of Google Cloud’s default organization policies.
- E
Use the gcloud CLI to enable policy evaluation and drift detection at the project level.
Show answer and explanation
Correct answers: B, C
Explanation
To manage policy enforcement and drift detection at scale, Config Validator allows you to define and validate custom constraint templates that can be integrated with Security Health Analytics. Additionally, enabling Security Health Analytics in Security Command Center and configuring custom modules ensures proactive monitoring of compliance violations. These tools together provide a scalable and effective solution for managing cloud security posture in a multi-project environment.
- A. Incorrect.
While organization policies can be defined and enforced through the Resource Manager API, this option does not address integrating custom policies into Security Health Analytics or supporting drift detection.
- B. Correct.
Config Validator is a tool specifically designed to define and validate custom policies, including constraint templates, which can be integrated with Security Health Analytics for monitoring violations.
- C. Correct.
Enabling Security Health Analytics in Security Command Center and configuring custom modules for policy compliance checks directly addresses the requirements of proactive monitoring and custom policy enforcement.
- D. Incorrect.
Forseti Security is a deprecated tool and is no longer recommended for use in Google Cloud environments. It does not support integration with Security Health Analytics or provide modern drift detection capabilities.
- E. Incorrect.
The gcloud CLI does not provide direct support for policy evaluation or drift detection at scale, as it is primarily a command-line tool for managing Google Cloud resources.