PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #118
You work at a financial services company. You need to detect in near real-time when a Cloud Run functions service agent modifies the IAM policy of an Artifact Registry repository. You plan to use…
The correct answer is C. Use Event Threat Detection in SCC with a custom unexpected Cloud API call rule that detects. The Google-recommended approach is to use Event Threat Detection (ETD) in Security Command Center (SCC) and configure a custom rule for unexpected Cloud API calls. This allows you to detect in near real-time when a specified principal (such as the Cloud Run functions service…
Question
You work at a financial services company. You need to detect in near real-time when a Cloud Run functions service agent modifies the IAM policy of an Artifact Registry repository. You plan to use Security Command Center (SCC). You want to follow the Google-recommended approach. What should you do?
Options
- ACreate a custom Security Health Analytics (SHA) detector that scans Artifact Registry repositories
- BConfigure a Cloud Logging log sink to export all IAM policy changes to BigQuery, and create a
- CUse Event Threat Detection in SCC with a custom unexpected Cloud API call rule that detects
- DImplement a Cloud Run function that is triggered by IAM policy changes within the project and
How the community answered
(51 responses)- A8% (4)
- B10% (5)
- C78% (40)
- D4% (2)
Explanation
The Google-recommended approach is to use Event Threat Detection (ETD) in Security Command Center (SCC) and configure a custom rule for unexpected Cloud API calls. This allows you to detect in near real-time when a specified principal (such as the Cloud Run functions service agent) modifies the IAM policy of an Artifact Registry repository, providing rapid and actionable alerts for this sensitive action.
Topics
Community Discussion
No community discussion yet for this question.