Google Professional Cloud Security Engineer Question 430
Select 4Google Cloud PlatformYour organization recently experienced a security incident where sensitive data was accessed. You are tasked with implementing a system in Google Cloud to improve detection, monitoring, and response to future incidents. Which actions should you take to meet this requirement?
- A
Enable Cloud Audit Logs for all services and ensure they are retained for an appropriate duration.
- B
Configure alerting policies in Cloud Monitoring to notify the security team of suspicious activities.
- C
Use Cloud Identity and Access Management (IAM) to assign the Owner role to all users for better visibility into resources.
- D
Set up an integration between Cloud Logging and a Security Information and Event Management (SIEM) solution.
- E
Enable VPC Flow Logs in all subnets to monitor network traffic for anomalies.
- F
Regularly delete all logs to reduce storage costs and prevent unauthorized access.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To improve detection, monitoring, and response to security incidents in Google Cloud, you must implement practices such as enabling logging (e.g., Cloud Audit Logs, VPC Flow Logs), configuring alerting tools (e.g., Cloud Monitoring), and integrating logs with a SIEM for advanced analytics. These measures collectively enhance visibility into your environment and facilitate timely response to security threats. Avoid actions that weaken security, such as assigning excessive permissions or deleting logs prematurely.
- A. Correct.
Enabling Cloud Audit Logs ensures that access and administrative actions are recorded and available for review during an incident investigation.
- B. Correct.
Configuring alerting policies in Cloud Monitoring allows you to detect and respond to security threats in real time.
- C. Incorrect.
Assigning the Owner role to all users is not a security best practice because it grants excessive permissions, increasing the risk of unintended actions or abuse.
- D. Correct.
Integrating Cloud Logging with a SIEM solution enables centralized analysis and correlation of security events, improving detection and response capabilities.
- E. Correct.
Enabling VPC Flow Logs provides visibility into network traffic patterns, which is critical for detecting anomalies and potential threats.
- F. Incorrect.
Deleting all logs regularly is not recommended as it impedes incident investigation and compliance efforts.