Google Professional Cloud Security Engineer Question 428
Select 3Google Cloud PlatformYour organization is deploying a new application on Google Cloud. As part of the security team, you are tasked with designing an effective logging strategy. The application is expected to handle sensitive customer data and must comply with regulatory requirements such as GDPR. Which actions should you take to ensure an effective and compliant logging strategy?
- A
Enable Cloud Audit Logs for all services, including Admin Activity, Data Access, and Policy Denied logs.
- B
Set up a centralized logging sink to export logs to a secure and immutable storage bucket with restricted access.
- C
Include sensitive user data such as personal information in logs to facilitate debugging and monitoring.
- D
Configure log retention policies to retain logs indefinitely to ensure compliance with GDPR requirements.
- E
Implement log exclusions to filter out unnecessary logs that do not contribute to security monitoring or compliance.
Show answer and explanation
Correct answers: A, B, E
Explanation
An effective logging strategy involves ensuring visibility into all critical activities through comprehensive logging, securing logs in centralized and immutable storage, and optimizing log data by excluding irrelevant entries. These actions help meet compliance requirements such as GDPR while maintaining a secure and efficient logging system. Including sensitive user data in logs and retaining logs indefinitely can conflict with privacy and compliance requirements, making these actions incorrect.
- A. Correct.
Enabling Cloud Audit Logs for all services ensures comprehensive visibility into activities and helps meet compliance requirements. This is an essential step for an effective logging strategy.
- B. Correct.
Exporting logs to a secure and centralized storage bucket with restricted access enhances security and ensures logs are protected from unauthorized access or tampering, which is crucial for compliance.
- C. Incorrect.
Including sensitive user data in logs violates privacy regulations such as GDPR, as it increases the risk of exposing personal data. Logs should be anonymized or sanitized to avoid this issue.
- D. Incorrect.
Retaining logs indefinitely is not a requirement of GDPR. Instead, GDPR requires that data, including logs, be retained only as long as necessary for the purposes for which it was collected.
- E. Correct.
Implementing log exclusions helps reduce noise and storage costs by filtering out irrelevant logs, allowing the organization to focus on logs that are critical for security monitoring and compliance.