Google Professional Cloud Security Engineer Question 412
Select 3Google Cloud PlatformYour organization has deployed a web application on Google Cloud using Compute Engine instances behind a global HTTP(S) load balancer. To ensure compliance with security requirements, you need to configure logging and monitoring to detect unauthorized access attempts and suspicious activities while minimizing log storage costs. Which actions should you take?
- A
Enable Cloud Logging on the HTTP(S) load balancer to capture request and response logs.
- B
Configure VPC Flow Logs for the subnet where the instances are located and set the sampling rate to 100%.
- C
Set up Cloud Monitoring alerts to notify when predefined metrics thresholds, such as high CPU utilization on the instances, are breached.
- D
Use Cloud Audit Logs to monitor Admin Activity and Data Access logs for the web application’s service account.
- E
Disable Stackdriver agent on the Compute Engine instances to avoid unnecessary performance overhead.
Show answer and explanation
Correct answers: A, B, D
Explanation
To detect unauthorized access attempts and suspicious activities, you need to configure logging and monitoring at multiple levels. Cloud Logging on the HTTP(S) load balancer provides application-level logs, while VPC Flow Logs offer network-level visibility. Cloud Audit Logs ensure accountability by tracking critical actions and access attempts. These configurations together provide a layered approach to monitoring and detection. Minimizing log storage costs may require tuning retention policies or sampling rates appropriately.
- A. Correct.
Enabling Cloud Logging on the HTTP(S) load balancer helps capture detailed request and response logs, which are essential for detecting unauthorized access attempts and anomalies.
- B. Correct.
VPC Flow Logs provide network-level visibility, and setting the sampling rate to 100% ensures all traffic is logged, enabling detailed analysis for suspicious activity. However, this could increase log storage costs.
- C. Incorrect.
While setting up CPU utilization alerts can be useful for performance monitoring, it is not directly related to detecting unauthorized access or suspicious activities.
- D. Correct.
Cloud Audit Logs allow you to track Admin Activity and Data Access, which is essential for monitoring who accessed the application and for detecting potentially unauthorized actions.
- E. Incorrect.
Disabling the Stackdriver agent on Compute Engine instances is not recommended because it limits visibility into instance-level metrics and logs, which might be needed for comprehensive monitoring.