Google Professional Cloud Security Engineer Question 446
Select 4Google Cloud PlatformYour organization uses Google Cloud and requires all logs from Cloud Logging to be exported to an external SIEM (Security Information and Event Management) system for advanced threat analysis. As a Professional Cloud Security Engineer, how can you configure log export while ensuring data security during transit and compliance with company policies?
- A
Create a sink in Cloud Logging to export logs to a Pub/Sub topic, and configure the external SIEM system to subscribe to the topic.
- B
Enable default log export to BigQuery and provide direct access to the BigQuery dataset for the external SIEM system.
- C
Create a sink in Cloud Logging to export logs to a Cloud Storage bucket, and configure the external SIEM system to pull logs from the bucket.
- D
Ensure that the Pub/Sub topic or Cloud Storage bucket used for log export is properly secured with IAM roles and encryption.
- E
Use a service account with minimal permissions to configure the external SIEM system's access to the exported logs.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
Exporting logs from Cloud Logging to external systems like an SIEM requires careful configuration to ensure both functionality and security. Pub/Sub and Cloud Storage are common and effective destinations for log export, depending on whether real-time or batch processing is needed. Security measures, including IAM role assignments, encryption, and the use of minimally privileged service accounts, are essential to protect log data during the export process. Direct access to BigQuery datasets is not recommended, as it bypasses these security measures and could expose sensitive data to unauthorized access.
- A. Correct.
Correct: Exporting logs via a Pub/Sub topic and allowing the SIEM to subscribe is a common and secure method for real-time log streaming.
- B. Incorrect.
Incorrect: Direct access to BigQuery for an external system may violate security best practices, as it doesn't provide appropriate controls for least privilege and log-specific access.
- C. Correct.
Correct: Exporting logs to a Cloud Storage bucket is a valid method, especially for batch processing or periodic ingestion by external systems.
- D. Correct.
Correct: Ensuring the destination (Pub/Sub topic or Cloud Storage bucket) is secured with appropriate IAM roles and encryption is critical for protecting sensitive log data.
- E. Correct.
Correct: Using a service account with minimal permissions adheres to the principle of least privilege, reducing the risk of unauthorized access to exported logs.