Your organization 1s developing a new SaaS application on Google Cloud. Stringent compliance standards require visibility into privileged account activity, and potentially unauthorized changes and…

Question

Options

• ACreate log sinks to Cloud Storage for long-term retention. Set up log-based alerts in Cloud
• BDeploy Cloud IDS and activate Firewall Rules Logging. Create a custom dashboard in Security
• CDetect sensitive administrative actions by using Cloud Logging with custom filters. Enable VPC
• DEnable Event Threat Detection and Security Health Analytics in Security Command Center. Set

• A
  4% (1)
• B
  17% (4)
• C
  9% (2)
• D
  70% (16)

Explanation

Option D is correct because Security Command Center (SCC) is Google Cloud's native security and risk management platform purpose-built for exactly these requirements. Event Threat Detection automatically analyzes Cloud Logging streams to flag suspicious administrative actions and IAM changes in near real-time, while Security Health Analytics continuously scans for misconfigurations and compliance violations - together addressing all three stated needs: privileged activity visibility, IAM change logging, and unauthorized configuration tracing.

Option A (log sinks to Cloud Storage) handles long-term retention but is passive storage - it doesn't provide active threat detection or misconfiguration analysis required by stringent compliance.

Option B (Cloud IDS + Firewall Rules Logging) targets network-level intrusion detection and traffic logging, not administrative actions or IAM permission changes - it's the wrong layer of the stack.

Option C (Cloud Logging with custom filters + VPC) requires manual filter creation and ongoing maintenance; it lacks the automated, intelligent detection of unauthorized changes that a compliance-driven environment demands, and VPC Flow Logs address network traffic, not IAM activity.

Memory tip: When the question mentions compliance + privileged accounts + misconfigurations, think SCC = "Security Control Center" - it's the all-in-one answer. If the question is about network threats/packets, reach for Cloud IDS; if it's about admin actions and config drift, reach for SCC with Event Threat Detection and Security Health Analytics.

No community discussion yet for this question.