An enterprise wants to establish a comprehensive auditing and monitoring framework for user-managed service account keys across hundreds of projects in its Google Cloud organization. The security operations team has defined the following technical requirements: Organization-Wide Inventory & Age Tracking: Discover and inventory all active user-managed service account keys across all projects, including their creation timestamps and metadata. Unused Key Identification: Identify dormant service account keys that have not performed authentication or API activity within the last 90 days to safely decommission them. Real-Time Alerting on Key Creation: Instantly notify the Security Operations Center (SOC) whenever a new service account key is generated anywhere in the organization. Which combination of Google Cloud services and configurations should the security team deploy to satisfy these requirements?

Query Cloud Asset Inventory for `iam.googleapis.com/ServiceAccountKey` assets to assess key inventory and age; leverage IAM Policy Intelligence service account key insights to detect unused keys; and configure an organization-level aggregated Cloud Logging sink filtering for `google.iam.admin.v1.CreateServiceAccountKey` Admin Activity logs connected to Cloud Monitoring and Pub/Sub alerting.: ### What this architecture is This architecture combines **Cloud Asset Inventory**, **Policy Intelligence (IAM key insights/recommenders)**, and **Cloud Logging aggregated sinks** with **Cloud Monitoring** to establish full lifecycle visibility, inactivity detection, and real-time detection of user-managed service account key creation across an entire organization. ### How it meets the requirements - **Organization-Wide Inventory & Age Tracking**: Cloud Asset Inventory provides a centralized metadata repository across all projects under an Organization node. Exporting or querying assets of type `iam.googleapis.com/ServiceAccountKey` reveals all existing user-managed keys, their associated service accounts, parent projects, and creation timestamps (`validAfterTime`). - **Unused Key Identification**: IAM Policy Intelligence continuously monitors service account key authentication activity. It surfaces service account key insights and recommendations identifying keys that have not been used to authenticate API requests over observation windows (such as 90 days), allowing security teams to confidently disable and delete inactive credentials. - **Real-Time Alerting on Key Creation**: An organization-level aggregated log sink captures `cloudaudit.googleapis.com/activity` logs across all child folders and projects. Filtering for `protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey"` captures all key creation events instantly and routes them to a Pub/Sub topic and Cloud Monitoring log-based alert for automated SOC notification. ### Key advantages and capabilities - **Centralized governance**: Eliminates the need to poll individual project IAM APIs iteratively. - **Detective automation**: Policy Intelligence automatically correlates activity without requiring custom log parsing of high-volume data streams. - **Immutable audit trails**: Admin Activity logs are recorded automatically without ingest costs and cannot be disabled by project-level users. ### Why this is optimal This approach uses Google Cloud-native governance and intelligence tools at the organization hierarchy root, ensuring zero blind spots across newly created or existing projects.

Audit Service Account Key Inventory Usage Alerts | Professional Cloud Security Engineer

Audit Service Account Key Inventory Usage Alerts

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise wants to establish a comprehensive auditing and monitoring framework for user-managed service account keys across hundreds of projects in its Google Cloud organization. The security operations team has defined the following technical requirements:

Organization-Wide Inventory & Age Tracking: Discover and inventory all active user-managed service account keys across all projects, including their creation timestamps and metadata.
Unused Key Identification: Identify dormant service account keys that have not performed authentication or API activity within the last 90 days to safely decommission them.
Real-Time Alerting on Key Creation: Instantly notify the Security Operations Center (SOC) whenever a new service account key is generated anywhere in the organization.

Which combination of Google Cloud services and configurations should the security team deploy to satisfy these requirements?

Query Cloud Asset Inventory for iam.googleapis.com/ServiceAccountKey assets to assess key inventory and age; leverage IAM Policy Intelligence service account key insights to detect unused keys; and configure an organization-level aggregated Cloud Logging sink filtering for google.iam.admin.v1.CreateServiceAccountKey Admin Activity logs connected to Cloud Monitoring and Pub/Sub alerting.

Deploy Network Analyzer across a multi-project metrics scope to identify aged keys; configure Firewall Rules Logging to detect unused keys; and use Security Command Center to block key generation via automated Cloud Functions.

Enable VPC Flow Logs across all subnets to capture service account authentication signatures; analyze Cloud SQL insights for dormant keys; and configure Data Access audit logs on all storage buckets to trigger Cloud Monitoring alerts upon key generation.

Configure Cloud Data Loss Prevention (Sensitive Data Protection) inspection scans on all Cloud Storage buckets; use Web Security Scanner to detect unused credentials; and set up an IAM Conditions policy to automatically expire keys after 90 days.

Professional Cloud Security Engineer

Audit Service Account Key Inventory Usage Alerts

Related questions