You work for a large international company with several Compute Engine instances running in production. You must configure monitoring and alerting for Compute Engine instances that are tagged compliance=pci and have an external IP address assigned. What should you do?
A Create a custom Event Threat Detection module that alerts when a Compute Engine instance with the compliance=pci tag is assigned an external IP address. B Deploy the compute.vmExternalIpAccess organization policy constraint to prevent specific projects or folders with the compliance=pci tag from creating Compute Engine instances with external IP addresses. C Create a custom Security Health Analytics (SHA) module. Configure the detection logic to scan Cloud Asset Inventory data for compute.googleapis.com/Instance assets, and Search for the compliance=pci tag. D Use the PUBLIC_IP_ADDRESS Security Health Analytics (SHA) detector to identify Compute Engine instances with external IP addresses. Determine whether the compliance=pci tag exists on the instances. Show Answer Answer Explanation The built-in Security Health Analytics PUBLIC_IP_ADDRESS detector generates a finding when a Compute Engine instance has a public IP address. The affected instances can be checked for the compliance=pci tag so that monitoring and alerting apply to the required subset without creating a redundant custom detector.
Learn more
Community Discussion