PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #22
During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role. You suspect that this is part of a larger…
The correct answer is D. Execute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter. The most direct and reliable way to confirm activity by the external identity is to query the centralized Cloud Logging bucket and BigQuery datasets for logs where the principalEmail matches the external identity. This provides a full historical record of the identity's actions…
Question
During a proactive threat hunting exercise, you discover that a critical production project has an external identity with a highly privileged IAM role. You suspect that this is part of a larger intrusion, and it is unknown how long this identity has had access. All logs are enabled and routed to a centralized organization-level Cloud Logging bucket, and historical logs have been exported to BigQuery datasets. You need to determine whether any actions were taken by this external identity in your environment. What should you do?
Options
- AUse Policy Analyzer to identity the resources that are accessible by the external identity. Examine
- BAnalyze VPC Flow Logs exported to BigQuery, and correlate source IP addresses with potential
- CAnalyze IAM recommender insights and Security Command Center (SCC) findings associated
- DExecute queries against the centralized Cloud Logging bucket and the BigQuery dataset to filter
How the community answered
(28 responses)- A7% (2)
- B14% (4)
- C4% (1)
- D75% (21)
Explanation
The most direct and reliable way to confirm activity by the external identity is to query the centralized Cloud Logging bucket and BigQuery datasets for logs where the principalEmail matches the external identity. This provides a full historical record of the identity's actions across projects and resources, allowing you to assess potential impact.
Topics
Community Discussion
No community discussion yet for this question.