Google Professional Cloud Security Engineer Question 440
Select 3Google Cloud PlatformYou are designing a secure logging solution for your organization on Google Cloud. The logs contain sensitive information, and access must be granted only to specific teams for compliance purposes. How can you ensure secure access to these logs while following best practices?
- A
Use Cloud IAM roles like 'Logs Viewer' to assign access only to specific users or groups.
- B
Enable audit logs for all services and grant access to the audit logs by assigning the 'Project Owner' role to the concerned teams.
- C
Use Log Buckets with custom IAM policies to segment logs and control access at the bucket level.
- D
Encrypt logs using Cloud KMS and restrict access to the encryption keys to authorized personnel.
- E
Store logs in a publicly accessible Cloud Storage bucket for easier sharing and monitoring.
Show answer and explanation
Correct answers: A, C, D
Explanation
To design a secure logging solution in Google Cloud, it is essential to follow the principle of least privilege by using roles like 'Logs Viewer' and applying custom IAM policies. Organizing logs into Log Buckets with specific access controls further enhances security. Additionally, encrypting logs with Cloud KMS and restricting access to encryption keys adds another layer of protection. Avoid practices that expose logs unnecessarily or provide excessive permissions, as these can compromise the security of sensitive information.
- A. Correct.
Using Cloud IAM roles like 'Logs Viewer' ensures that only specific users or groups can view the logs. This is a best practice for implementing least privilege access.
- B. Incorrect.
Granting the 'Project Owner' role provides excessive permissions and violates the principle of least privilege. It is not a recommended approach for securing logs.
- C. Correct.
Log Buckets allow you to organize and manage log data efficiently. Applying custom IAM policies to these buckets enables fine-grained access control.
- D. Correct.
Encrypting logs with Cloud KMS ensures that sensitive data is protected at rest. Restricting access to the encryption keys further secures the logs.
- E. Incorrect.
Storing logs in a publicly accessible Cloud Storage bucket exposes sensitive information to unauthorized access and is not secure.