Google Professional Cloud Security Engineer Question 438
Select 3Google Cloud PlatformYour organization wants to ensure secure access to Cloud Logging data. You need to design a solution that allows only specific team members to access logs related to a critical production application. The team must also ensure compliance by preventing unauthorized access to sensitive log entries, such as personally identifiable information (PII). Which of the following actions should you take?
- A
Use Cloud IAM roles to grant the team members the 'Logs Viewer' role for the specific log bucket containing production application logs.
- B
Create a custom IAM role with fine-grained permissions for reading only specific log entries, and assign it to the team members.
- C
Enable log-based access policies to restrict access to log entries containing sensitive data.
- D
Use Cloud Logging sinks to export logs to a secure Cloud Storage bucket and configure IAM permissions on the bucket.
- E
Encrypt log entries using Customer-Managed Encryption Keys (CMEK) and share the encryption key with the team members.
Show answer and explanation
Correct answers: A, B, D
Explanation
To design secure access to logs, it's critical to use IAM roles and permissions effectively to ensure only authorized users can access logs. Granting the 'Logs Viewer' role for specific log buckets and creating custom IAM roles for finer control maintain security and compliance. Exporting logs to a secure Cloud Storage bucket via logging sinks provides additional isolation and control for sensitive logs. Encryption using CMEK is not a substitute for access control, and log-based access policies are not a feature in Cloud Logging.
- A. Correct.
Correct: Granting the 'Logs Viewer' role for the specific log bucket ensures that team members only have access to the relevant logs and not all logs in the organization.
- B. Correct.
Correct: A custom IAM role allows you to define precise permissions for accessing specific log entries, ensuring compliance with the principle of least privilege.
- C. Incorrect.
Incorrect: Log-based access policies are not a feature in Cloud Logging. Access control is managed using IAM roles and permissions.
- D. Correct.
Correct: Using logging sinks to export logs to a secure Cloud Storage bucket can further control access by leveraging fine-grained IAM permissions on the bucket. This is especially useful for isolating sensitive logs.
- E. Incorrect.
Incorrect: Encrypting log entries with CMEK does not inherently restrict access. Access control is managed through IAM roles and permissions, not encryption keys.