Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ193

Configuring access

A security audit identified several inconsistencies in your project's Identity and Access Management (IAM) configuration. Some service accounts hold excessively permissive roles, and several external collaborators have more access than needed. You need detailed visibility into IAM policy changes, user activity, service account behavior, and access to sensitive projects. What should you do?

  • A Configure Google Cloud Functions to be triggered by changes to IAM policies. Analyze changes by using the policy simulator, send alerts upon risky modifications, and store event details.
  • B Enable the metrics explorer in Cloud Monitoring to follow the service account authentication events and build alerts linked on it.
  • C Use Cloud Audit Logs. Create log export sinks to send these logs to a security information and event management (SIEM) solution for correlation with other event sources.
  • D Deploy the OS Config Management agent to your VMs. Use OS Config Management to create patch management jobs and monitor system modifications.
Explanation

Cloud Audit Logs records administrative and access activities across Google Cloud resources. Admin Activity logs include IAM permission changes, and Data Access logs can provide resource-access visibility when enabled. IAM audit logging includes service account events, while Cloud Logging sinks can route the audit logs to a SIEM for correlation with other security data sources.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!