Google Professional Cloud Security Engineer Question 463
Select 3Google Cloud PlatformYour organization has enabled Security Command Center (SCC) Premium tier on Google Cloud to monitor and manage security risks. While reviewing findings in SCC, you notice that some high-severity vulnerabilities are not being addressed promptly by the responsible teams. You want to ensure that key team members are notified automatically whenever critical or high-severity findings are detected. Which of the following steps will help you achieve this?
- A
Create a Cloud Function that listens to SCC notifications via Pub/Sub and sends alerts to the team.
- B
Set up a Pub/Sub topic for SCC notifications and configure email subscriptions for the team.
- C
Use Cloud Monitoring to create an alerting policy based on SCC finding severity levels.
- D
Enable SCC's built-in email alerting feature for critical and high-severity findings.
- E
Integrate SCC with a third-party SIEM tool to send notifications for critical findings.
Show answer and explanation
Correct answers: A, B, C
Explanation
To ensure that key team members are notified about critical or high-severity findings in SCC, you can use Pub/Sub to process SCC notifications and send alerts to the team. This can be done by setting up email subscriptions to a Pub/Sub topic or using a Cloud Function to automate the alerting process. Additionally, Cloud Monitoring can be configured to create alerting policies based on the severity of SCC findings. These methods are effective and align with best practices for automating security notifications in Google Cloud.
- A. Correct.
Correct: Using a Cloud Function triggered by Pub/Sub notifications is a valid method to process SCC findings and send alerts to the appropriate team.
- B. Correct.
Correct: Configuring a Pub/Sub topic and email subscriptions allows SCC notifications to be automatically sent to specific recipients through email.
- C. Correct.
Correct: Cloud Monitoring can be used to create alerting policies based on SCC finding severity levels, ensuring notifications are sent when certain thresholds are met.
- D. Incorrect.
Incorrect: SCC does not have a built-in feature to directly send email alerts for findings. Notifications must be managed through Pub/Sub or other integrations.
- E. Incorrect.
Incorrect: While integrating SCC with a third-party SIEM is a common practice for centralizing security events, it does not directly address the need to notify team members automatically.