Google Professional Cloud Security Engineer Question 415
Select 4Google Cloud PlatformYour team manages a Google Cloud project that hosts a critical application. To improve security and ensure compliance, you need to configure logging, monitoring, and detection for the project. Which of the following actions should you take to meet this goal?
- A
Enable Cloud Audit Logs for Admin Activity and Data Access for all services.
- B
Set up Google Cloud's Security Command Center Premium to monitor security risks.
- C
Disable Stackdriver Logging to reduce costs for the project.
- D
Configure custom alerts in Cloud Monitoring for unusual activity patterns.
- E
Use Pub/Sub to export logs to an external SIEM (Security Information and Event Management) tool.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To ensure a secure and compliant environment in Google Cloud, you must enable logging for administrative and data activity, utilize tools like the Security Command Center for advanced monitoring, set up custom alerts for unusual activity, and integrate logs with external security systems like SIEM tools. Disabling logging is not a valid approach as it undermines the goals of security and compliance.
- A. Correct.
Correct: Enabling Cloud Audit Logs for Admin Activity and Data Access ensures that all administrative actions and data access events are recorded, which is critical for compliance and incident detection.
- B. Correct.
Correct: Security Command Center Premium provides advanced monitoring and detection capabilities for identifying and responding to security risks, making it crucial for securing your project.
- C. Incorrect.
Incorrect: Disabling Stackdriver Logging (now part of Cloud Logging) would prevent critical security and operational data from being recorded, which is counterproductive for logging and monitoring requirements.
- D. Correct.
Correct: Custom alerts in Cloud Monitoring can help identify unusual activity patterns, which is essential for proactive threat detection.
- E. Correct.
Correct: Exporting logs to an external SIEM using Pub/Sub enables advanced log analysis and integration with existing security workflows, enhancing detection and response capabilities.