Google Professional Cloud Security Engineer Question 416
Select 2Google Cloud PlatformYour organization uses Google Cloud and has deployed multiple services across several projects. To meet compliance requirements, you need to ensure all API calls to critical resources are logged, and you must set up alerts for unusual activity patterns, such as access from unknown IP ranges. Which of the following steps should you take to achieve this?
- A
Enable Audit Logs for all critical services and resources.
- B
Set up a Cloud Pub/Sub topic to capture logs and use a custom application to analyze them.
- C
Configure Log-based Alerts in Cloud Monitoring to detect unusual activity patterns.
- D
Use VPC Flow Logs to monitor all network traffic and set up alerts for anomalies.
- E
Enable Cloud Asset Inventory to track all resource changes in real time.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the compliance requirements and detect unusual activity patterns, you need to enable Audit Logs for critical services to capture all API calls and set up Log-based Alerts in Cloud Monitoring to analyze logs for patterns like access from unknown IP ranges. These native features are specifically designed for logging and monitoring activities in Google Cloud.
- A. Correct.
Enabling Audit Logs ensures that all API calls to critical resources are logged, which is essential for compliance and monitoring purposes.
- B. Incorrect.
Using a Cloud Pub/Sub topic and a custom application to analyze logs is unnecessary when native tools like Cloud Monitoring and Log-based Alerts are available for detecting unusual activity patterns.
- C. Correct.
Configuring Log-based Alerts in Cloud Monitoring is the appropriate method to detect unusual activity patterns, such as access from unknown IP ranges.
- D. Incorrect.
VPC Flow Logs monitor network traffic but are not specific to API calls or resource access. They are not the most relevant tool for this scenario.
- E. Incorrect.
Cloud Asset Inventory provides visibility into resource inventory and changes but does not handle logging or activity detection.