Google Professional Cloud Security Engineer Question 414
Select 4Google Cloud PlatformYour organization hosts multiple critical workloads on Google Cloud and has a compliance requirement to detect potential security breaches in real-time. You need to set up a logging, monitoring, and detection system that meets the following requirements:
- Logs from all projects must be collected in a central location.
- Anomaly detection alerts must be generated when unusual behavior is detected in network traffic.
- Investigators must be able to trace the source of incidents efficiently.
Which combination of steps should you take to meet these requirements?
- A
Configure a centralized Logging bucket in Cloud Logging and route logs from all projects to it.
- B
Enable VPC Flow Logs and integrate them with Cloud Pub/Sub for real-time analysis.
- C
Use Cloud Monitoring to create uptime checks and custom dashboards for anomaly detection.
- D
Enable Cloud Security Command Center (SCC) Premium and configure it to monitor for threats across all projects.
- E
Set up log-based alerts in Cloud Logging to notify your team when specific patterns are detected.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
This scenario requires a combination of centralized logging, anomaly detection, and real-time alerting. Centralized Logging buckets collect logs from all projects for compliance and traceability. VPC Flow Logs provide visibility into network traffic, which is essential for detecting unusual behavior. Cloud SCC Premium offers advanced threat detection and monitoring across projects, while log-based alerts ensure the team is notified of anomalies in real-time. Uptime checks and dashboards, while useful, are not sufficient to meet the requirements outlined in this scenario.
- A. Correct.
Correct: Centralizing logs in a Logging bucket ensures all logs are stored in one place, which is critical for compliance and incident tracing.
- B. Correct.
Correct: Enabling VPC Flow Logs and integrating them with real-time analysis tools helps detect unusual network behavior, fulfilling the anomaly detection requirement.
- C. Incorrect.
Incorrect: While uptime checks and dashboards are useful for monitoring service availability, they are not directly used for anomaly detection or centralized logging.
- D. Correct.
Correct: Cloud SCC Premium provides advanced threat detection and monitoring capabilities across multiple projects, which aligns with the compliance and detection requirements.
- E. Correct.
Correct: Log-based alerts can notify the team of specific patterns or anomalies, contributing to real-time security breach detection.