Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ1

Observability

You work for a large international company with several Compute Engine instances running in production. You must configure monitoring and alerting for Compute Engine instances that are tagged compliance=pci and have an external IP address assigned. What should you do?

  • A Create a custom Event Threat Detection module that alerts when a Compute Engine instance with the compliance=pci tag is assigned an external IP address.
  • B Deploy the compute.vmExternalIpAccess organization policy constraint to prevent specific projects or folders with the compliance=pci tag from creating Compute Engine instances with external IP addresses.
  • C Create a custom Security Health Analytics (SHA) module. Configure the detection logic to scan Cloud Asset Inventory data for compute.googleapis.com/Instance assets, and Search for the compliance=pci tag.
  • D Use the PUBLIC_IP_ADDRESS Security Health Analytics (SHA) detector to identify Compute Engine instances with external IP addresses. Determine whether the compliance=pci tag exists on the instances.
Explanation

The built-in Security Health Analytics PUBLIC_IP_ADDRESS detector generates a finding when a Compute Engine instance has a public IP address. The affected instances can be checked for the compliance=pci tag so that monitoring and alerting apply to the required subset without creating a redundant custom detector.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!