AZ-500 Question 231
Select 2Your organization hosts applications in Google Cloud Platform (GCP) and wants to ingest security alerts from GCP into Microsoft Defender for Cloud for a unified view of security posture. The security team has already created a dedicated GCP service account and assigned the appropriate Security Command Center roles to it, but they're unsure about the final steps needed. Which two actions must you take to complete the integration so that GCP security alerts appear in Microsoft Defender for Cloud?
- A
In the Azure portal, navigate to Microsoft Defender for Cloud > Environment settings, add a GCP connector, and provide the GCP service account credentials.
- B
Deploy the Azure Arc agent to all GCP virtual machines to forward logs and alerts to Microsoft Defender for Cloud.
- C
Enable the Security Command Center API in your GCP projects or organization to ensure findings flow into Microsoft Defender for Cloud.
- D
Create a new Azure Active Directory service principal for GCP and assign it to the subscription that hosts Microsoft Defender for Cloud.
Show answer and explanation
Correct answers: A, C
Explanation
To connect GCP to Microsoft Defender for Cloud, you need to enable the Security Command Center API in GCP and provision a service account with the appropriate roles. Then, in the Azure portal under Microsoft Defender for Cloud > Environment settings, add a GCP connector and provide the service account credentials. This setup allows Defender for Cloud to access Security Command Center findings in GCP and surface any alerts or posture recommendations. For more details, refer to Microsoft Defender for Cloud documentation on onboarding GCP projects: https://learn.microsoft.com/azure/defender-for-cloud/connect-google-cloud#onboarding-gcp-projects.
- A. Correct.
Correct. This is a required step for connecting GCP to Microsoft Defender for Cloud. You must add GCP as a connected cloud under Environment settings in Defender for Cloud and configure the GCP service account credentials to allow Defender for Cloud to retrieve security findings.
- B. Incorrect.
Incorrect. Deploying the Azure Arc agent is useful for managing and monitoring hybrid servers, but it is not required to pull Security Command Center findings from GCP into Microsoft Defender for Cloud. The built-in connector is what ingests alerts and posture data, not the Arc agent.
- C. Correct.
Correct. Even though you have created a service account with the right roles, you must also enable the Security Command Center API on the GCP side. Without enabling this API, no findings will be generated or sent to Microsoft Defender for Cloud.
- D. Incorrect.
Incorrect. You do not need to create an Azure AD service principal specifically for the GCP integration. The GCP connector in Microsoft Defender for Cloud relies on a GCP service account with the appropriate roles, not on an Azure AD principal.