Audit Impersonation Service Account Delegation Info

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security operations team is investigating unauthorized modifications made to sensitive cloud storage buckets. The actions were executed directly by a privileged deployment service account. The team needs to trace the authentic originating human principal who initiated the impersonated session and prevent future credential exfiltration risks by enforcing short-lived impersonation workflows enterprise-wide.

Which combination of Cloud Audit Log inspection and Organization Policy enforcement should the security engineer implement?

Inspect protoPayload.requestMetadata.callerIp to correlate the human identity via external IdP logs, and enforce the iam.allowedPolicyMemberDomains organization policy constraint.

Inspect protoPayload.serviceData.policyDelta to trace the token generation permissions, and enforce the compute.setNewProjectDefaultToZonalDNSOnly organization policy constraint.

Inspect protoPayload.authenticationInfo.serviceAccountDelegationInfo in Cloud Audit Logs to identify the originating principal in the delegation chain, and enforce the iam.disableServiceAccountKeyCreation organization policy constraint.

Inspect protoPayload.authenticationInfo.principalEmail to view the originating caller, and enforce the iam.disableCrossProjectServiceAccountUsage organization policy constraint.

Professional Cloud Security Engineer

Audit Impersonation Service Account Delegation Info

Related questions