A security team at an e-commerce company wants to define an automatic incident response process for fraudulent credit card usage attempts. The team targets a 10-minute or faster response time for…

Question

Options

• ADefine a log-based metric for each fraudulent credit card, and set a Stackdriver alert for these
• BMaintain a log ingestion exclusion filter based on the fraudulent credit card lists.
• CUse AutoML to automatically build models based on the fraudulent credit card lists.
• DCreate a new logging export with a filter to match the transaction and a sink pointing to a Cloud

• A
  5% (1)
• B
  23% (5)
• C
  14% (3)
• D
  59% (13)

Explanation

The requirements are: near-real-time response (<10 minutes), fraudulent card list updated every 60 seconds, and transaction logs arriving in near-real-time. Creating a log export sink to Cloud Pub/Sub with a filter matching transaction log entries enables a streaming pipeline. A Cloud Function or Dataflow job subscribed to the Pub/Sub topic can cross-reference transactions against the up-to-date fraudulent card list and trigger automated incident responses within seconds - well within the 10-minute SLA. Option A (log-based metrics with Stackdriver alerts) has higher latency and is not designed for per-card incident automation. Option B (log ingestion exclusion filters) discards logs rather than triggering responses. Option C (AutoML) requires model training cycles and is not suited for near-real-time rule-based fraud matching.

No community discussion yet for this question.