Data Lake Security Monitoring Audit Logs Scc

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise operates a multitenant data lake on Google Cloud using Cloud Storage and BigQuery to process sensitive analytics workloads. The security team requires a centralized monitoring strategy to detect unauthorized activities, identify anomalous Identity and Access Management (IAM) privilege escalations, and track defense evasion attempts—such as unauthorized modifications to VPC Service Controls perimeters or disabling secure transport policies on storage buckets.

Which solution should you implement to meet these security monitoring and data governance requirements?

Configure VPC Flow Logs across all subnets and use BigQuery scheduled queries to evaluate network telemetry for unauthorized IP addresses accessing Cloud Storage APIs.

Export Cloud Storage access logs to a Cloud Logging bucket and configure Cloud Monitoring alerting policies based on custom metric counters for storage bucket metadata operations.

Enable Data Access audit logs with DATA_READ enabled on the data lake storage resources, and activate Security Command Center with Event Threat Detection to analyze Cloud Audit Logs for anomalous IAM behaviors and defense evasion.

Deploy custom Cloud Functions triggered by Cloud Pub/Sub to parse all Admin Activity logs and execute custom scripts that revoke IAM roles whenever changes occur.

Professional Cloud Data Engineer

Data Lake Security Monitoring Audit Logs Scc

Related questions