Google Professional Cloud Security Engineer Question 437
Select 4Google Cloud PlatformYour organization uses Google Cloud Logging to store application logs. To ensure secure access to these logs, you need to implement a solution that restricts access to logs based on user roles, provides the ability to audit access to logs, and prevents unauthorized access. Which of the following measures should you implement?
- A
Use predefined IAM roles such as 'Logs Viewer' to grant appropriate access to logs.
- B
Enable Access Transparency to audit log access by Google administrators.
- C
Grant the 'Owner' role to all team members for unrestricted access to logs.
- D
Configure CMEK (Customer-Managed Encryption Keys) for log data encryption to control access to logs at the encryption level.
- E
Set up VPC Service Controls to define service perimeters for Google Cloud Logging.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To design secure access to logs, it is essential to implement role-based access control using predefined IAM roles, enable auditing capabilities like Access Transparency, and enforce encryption with customer-managed keys to secure log data. Additionally, using VPC Service Controls provides another layer of security by restricting access to Google Cloud services. Granting unrestricted access, such as assigning the 'Owner' role to all users, is not aligned with security best practices.
- A. Correct.
Using predefined IAM roles such as 'Logs Viewer' ensures that access to logs is granted based on the principle of least privilege, which is critical for secure access.
- B. Correct.
Enabling Access Transparency allows you to audit log access by Google administrators, ensuring compliance and oversight for log access.
- C. Incorrect.
Granting the 'Owner' role to all team members violates the principle of least privilege and introduces security risks by providing unrestricted access.
- D. Correct.
Configuring CMEK for log data encryption adds an additional layer of security by allowing you to control and manage encryption keys, preventing unauthorized access to encrypted log data.
- E. Correct.
Setting up VPC Service Controls helps secure Google Cloud services, including Logging, by restricting access to specific service perimeters, reducing the risk of data exfiltration.