Google Professional Cloud Security Engineer Question 500
Select 3Google Cloud PlatformYour organization operates in a regulated industry and must comply with specific audit logging and network segmentation requirements outlined by a compliance framework. You are tasked with designing the Google Cloud architecture to meet these requirements. Which of the following Google Cloud services and configurations should you implement to ensure compliance with the audit logging and network segmentation requirements?
- A
Enable Cloud Audit Logs for Admin, Data Access, and System Event logs to monitor all activities in your environment.
- B
Use VPC Service Controls to define service perimeters and restrict data exfiltration from Google Cloud services.
- C
Configure Google Cloud Armor to block unauthorized access to resources by external users.
- D
Enable VPC Flow Logs to capture network traffic metadata for analysis and monitoring.
- E
Use Identity-Aware Proxy (IAP) to restrict access to applications based on user identity and context.
Show answer and explanation
Correct answers: A, B, D
Explanation
To comply with audit logging and network segmentation requirements, it is essential to enable Cloud Audit Logs for activity monitoring, leverage VPC Service Controls for network segmentation, and use VPC Flow Logs for network traffic analysis. These services and configurations collectively ensure compliance by providing comprehensive logging and monitoring capabilities, as well as robust network isolation.
- A. Correct.
Enabling Cloud Audit Logs for Admin, Data Access, and System Event logs ensures comprehensive logging of actions within your Google Cloud environment, which is critical for meeting audit logging requirements.
- B. Correct.
VPC Service Controls provide strong network segmentation by defining service perimeters, which helps ensure compliance with network segmentation requirements and prevents unauthorized data access.
- C. Incorrect.
Google Cloud Armor is designed to protect applications against DDoS attacks and unauthorized external access, but it does not directly address audit logging or network segmentation requirements.
- D. Correct.
VPC Flow Logs capture metadata about network traffic, which can be used to monitor and validate network segmentation compliance and detect anomalies.
- E. Incorrect.
Identity-Aware Proxy (IAP) is useful for controlling access to applications based on user identity and context, but it does not address audit logging or network segmentation requirements.