Google Professional Cloud Security Engineer Question 439
Select 3Google Cloud PlatformYou are managing a Google Cloud project with sensitive application logs stored in Cloud Logging. To ensure secure access to these logs, you need to implement a least-privilege access model while also allowing specific teams to analyze logs for troubleshooting. Which of the following steps should you take?
- A
Create custom IAM roles with the necessary permissions for log analysis and assign them to respective teams.
- B
Grant the 'Viewer' role at the project level to all users who need access to logs.
- C
Use log sinks to export logs to a secure Cloud Storage bucket and provide access to specific users or groups.
- D
Enable VPC Service Controls to restrict access to the Cloud Logging API from outside defined perimeters.
- E
Grant the 'Owner' role to the troubleshooting team to ensure full access to logs.
Show answer and explanation
Correct answers: A, C, D
Explanation
To design secure access to logs, it is critical to follow the principle of least privilege by creating custom IAM roles and using log sinks for fine-grained access control. Additionally, enabling VPC Service Controls ensures that access to sensitive logs is restricted to trusted networks and complies with security best practices. Avoid granting broad roles like 'Viewer' or 'Owner' which can expose sensitive data unnecessarily.
- A. Correct.
Creating custom IAM roles with specific permissions ensures that you follow the principle of least privilege, allowing users to perform their job without granting unnecessary access.
- B. Incorrect.
Granting the 'Viewer' role at the project level is too broad and violates the principle of least privilege, as it gives access to all resources in the project, not just logs.
- C. Correct.
Using log sinks to export logs to a secure Cloud Storage bucket allows you to control access at the bucket level, ensuring only authorized users or groups can view or analyze logs.
- D. Correct.
Enabling VPC Service Controls adds an additional layer of security by restricting access to the Cloud Logging API from outside a defined secure perimeter.
- E. Incorrect.
Granting the 'Owner' role provides excessive permissions beyond what is needed for troubleshooting and violates the principle of least privilege.