Professional Security Operations EngineerDemo

By Google · Question Mode

QuestionQ52

Detection engineering

You work for a financial services company. You need to detect, in near real time, when a Cloud Run functions service agent changes the IAM policy of an Artifact Registry repository. You plan to use Security Command Center (SCC) and want to follow Google's recommended approach. What should you do?

  • A Create a custom Security Health Analytics (SHA) detector that scans Artifact Registry repositories for IAM policy changes. When a change is detected identify the principal that made the change.
  • B Configure a Cloud Logging log sink to export all IAM policy changes to BigQuery, and create a custom dashboard in SCC to visualize the data.
  • C Use Event Threat Detection in SCC with a custom unexpected Cloud API call rule that detects when a specified principal calls a method against a resource.
  • D Implement a Cloud Run function that is triggered by IAM policy changes within the project and sends an alert to SCC using the Security Command Center API.
Explanation

Security Command Center Event Threat Detection continuously analyzes Cloud Audit Logs in near real time. Its configurable Unexpected Cloud API Call custom module detects a specified principal calling a specified method against a specified resource when the configured patterns match one log entry. It can therefore match the Cloud Run functions service agent, the Artifact Registry IAM policy update method, and the target repository.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!