Google Professional Cloud Security Engineer Question 445
Select 3Google Cloud PlatformYour organization uses Google Cloud and has a requirement to export Cloud Audit Logs to an external SIEM (Security Information and Event Management) system for advanced threat detection and compliance reporting. To ensure all logs are exported securely and in real-time, which of the following steps should you take?
- A
Create a sink in Cloud Logging to export logs to a Pub/Sub topic and configure the external SIEM to pull logs from the Pub/Sub topic.
- B
Grant the Pub/Sub Publisher role to the Cloud Logging service account for the selected Pub/Sub topic.
- C
Create a sink in Cloud Logging to export logs directly to the external SIEM using a custom API endpoint.
- D
Configure the external SIEM to pull logs directly from the Cloud Logging API without creating a sink.
- E
Enable the necessary Cloud Audit Logs for all services and resources in the organization.
Show answer and explanation
Correct answers: A, B, E
Explanation
To securely and efficiently export logs to an external SIEM, you should use Cloud Logging sinks to route logs to a Pub/Sub topic. The SIEM can then subscribe to this topic to receive logs in real-time. Additionally, you must grant the necessary permissions for Cloud Logging to publish to Pub/Sub and ensure all required logs are enabled in Cloud Audit Logs. This solution follows Google Cloud's best practices for integrating with external security systems.
- A. Correct.
This is correct. Creating a sink in Cloud Logging to export logs to a Pub/Sub topic is a recommended approach to integrate with external systems like SIEMs.
- B. Correct.
This is correct. Granting the Pub/Sub Publisher role to the Cloud Logging service account ensures logs can be published to the Pub/Sub topic for further processing.
- C. Incorrect.
This is incorrect. Exporting logs directly to an external SIEM via a custom API is not a recommended or supported method in Google Cloud.
- D. Incorrect.
This is incorrect. SIEMs cannot directly pull logs from the Cloud Logging API without creating a sink, as this would bypass the recommended export architecture.
- E. Correct.
This is correct. Enabling the appropriate Cloud Audit Logs ensures that all necessary logs are captured for export to the external SIEM.