Google Professional Cloud Security Engineer Question 433
Select 3Google Cloud PlatformYour organization runs multiple services on Google Cloud Platform (GCP) and wants to improve its ability to detect and respond to security incidents. You are tasked with designing a logging and monitoring strategy. Which of the following steps should you implement to ensure comprehensive incident detection and response capabilities?
- A
Enable Cloud Audit Logs for all services, including Admin Activity, Data Access, and System Event logs.
- B
Set up log sinks to export logs to a secure external destination, such as a Cloud Storage bucket, for long-term retention.
- C
Configure alerts in Cloud Monitoring to notify the team only for critical incidents to avoid alert fatigue.
- D
Deploy Security Command Center Premium to gain centralized visibility into vulnerabilities and threats.
- E
Rely on default metrics in Cloud Monitoring and avoid creating custom metrics for anomalous activity detection.
Show answer and explanation
Correct answers: A, B, D
Explanation
To design a comprehensive logging and monitoring strategy, you need to ensure visibility into all activities (via Cloud Audit Logs), secure log retention for forensic analysis, and leverage advanced tools like Security Command Center Premium for proactive incident detection. While configuring alerts and using default metrics are helpful, they need to be complemented with tailored approaches to avoid gaps in detection.
- A. Correct.
Enabling Cloud Audit Logs for all services ensures that you have visibility into important activities, including access to resources and changes to configurations. This is essential for detecting and investigating incidents.
- B. Correct.
Exporting logs to a secure external destination ensures that logs are retained for compliance and forensic purposes, even if attackers attempt to delete or modify logs in GCP.
- C. Incorrect.
While configuring alerts is important, limiting notifications to only critical incidents can result in missing minor but potentially important security anomalies. A more balanced approach is required.
- D. Correct.
Security Command Center Premium provides advanced threat detection and centralized visibility into vulnerabilities, which is crucial for proactive incident response.
- E. Incorrect.
Relying solely on default metrics in Cloud Monitoring may limit your ability to detect specific types of anomalous activity. Custom metrics should be created to tailor monitoring to your organization's needs.