Google Professional Cloud Security Engineer Question 411
Single answerGoogle Cloud PlatformYour organization has a large number of projects in Google Cloud. To improve security posture management, you implemented custom organization policies to restrict the use of certain APIs (e.g., enabling APIs only approved for production). However, you also want to continuously monitor for policy violations and automatically remediate them at scale. Which solution would best meet these requirements?
- A
Use Security Health Analytics with custom modules to detect and remediate policy violations in real-time.
- B
Enable Cloud Audit Logs and manually review logs for policy violations.
- C
Implement Forseti Security to enforce organization policies and automatically remediate violations.
- D
Use Google Cloud Asset Inventory to monitor policy violations and manually take corrective actions.
Show answer and explanation
Correct answer: A
Explanation
Security Health Analytics, part of the Security Command Center, is purpose-built for monitoring and detecting security risks, including custom organization policy violations. By creating custom modules, you can tailor its functionality to detect specific policy violations. Combined with automation tools, it allows for real-time detection and remediation, making it the best solution for managing policy drift at scale.
- A. Correct.
Security Health Analytics can be extended with custom modules to monitor and detect policy violations at scale. It also integrates with automation tools to trigger remediation actions.
- B. Incorrect.
While Cloud Audit Logs provide detailed logs of activity in your projects, they are not designed for real-time detection or automated remediation of policy violations. Manual review is inefficient at scale.
- C. Incorrect.
Forseti Security was historically used for policy enforcement but is now deprecated and no longer recommended for new implementations. Google recommends using tools like Security Command Center for modern security posture management.
- D. Incorrect.
Google Cloud Asset Inventory provides insights into your resources but does not have built-in capabilities for automatic detection or remediation of policy violations. It would require significant manual effort.