A company has been running their application on Compute Engine. A bug in the application allowed a malicious user to repeatedly execute a script that results in the Compute Engine instance crashing…

Question

Options

• ACreate an Alerting Policy in Stackdriver using a Process Health condition, checking that the
• BCreate an Alerting Policy in Stackdriver using the CPU usage metric. Set the threshold to 80% to
• CLog every execution of the script to Stackdriver Logging. Create a User-defined metric in
• DLog every execution of the script to Stackdriver Logging. Configure BigQuery as a log sink, and

• A
  70% (28)
• B
  8% (3)
• C
  18% (7)
• D
  5% (2)

Explanation

Creating a Stackdriver (now Cloud Monitoring) Alerting Policy with a Process Health condition (A) is the most direct solution. A Process Health check monitors whether a specific process is running on the instance. If the malicious script crashes the instance (or kills a critical process), the condition will trigger and send an alert. This requires no code changes to the application. Option B (CPU threshold at 80%) is an indirect indicator - CPU spikes may have many causes and would generate false positives. Options C and D both require instrumenting the application to log each script execution before alerting, adding development overhead. Option D additionally relies on BigQuery for analysis, which introduces latency and is better suited for forensics than real-time alerting.

No community discussion yet for this question.