A financial services organization hosted on Google Cloud must comply with strict regulatory auditability and threat monitoring requirements across all existing and future projects in its resource hierarchy. The compliance and security teams mandate the following requirements: Capture all Admin Activity and full Data Access audit logs (DATA_READ, DATA_WRITE, and ADMIN_READ) across all services. Centrally aggregate all audit log entries across the entire resource hierarchy without missing newly created projects. Store audit logs in an immutable archive for seven years that prevents modification or premature deletion by any identity, including administrators. Detect threat behaviors in near real-time, such as anomalous IAM role grants and privilege escalation attempts. Which architecture should the security engineer implement to satisfy these compliance and monitoring requirements?

Enable Data Access audit logs for all services in the Organization's default IAM audit configuration; configure an aggregated log sink at the Organization level with `includeChildren=true` targeting a dedicated Cloud Storage bucket; enforce a 7-year retention policy locked with Bucket Lock; and enable Security Command Center with Event Threat Detection.: ### What the Solution Is This architecture establishes a centralized, organization-wide logging, immutable retention, and automated threat detection framework using Google Cloud native compliance controls. ### How It Meets the Requirements - **Comprehensive Audit Coverage**: Configuring the default audit configuration at the root **Organization** level enables `DATA_READ`, `DATA_WRITE`, and `ADMIN_READ` log types across all services and child resources. Admin Activity logs are enabled by default. - **Central Aggregation**: Deploying an **aggregated log sink** at the Organization level with `includeChildren=true` intercepts and routes all audit log entries from all current and future folders and projects into a centralized compliance destination. - **Immutable Retention**: Applying a 7-year retention policy to a dedicated **Cloud Storage** bucket and securing it with **Bucket Lock** enforces Write-Once-Read-Many (WORM) storage. Once locked, the retention policy cannot be removed, reduced, or bypassed by any principal or administrator. - **Threat Detection**: **Security Command Center (SCC)** with **Event Threat Detection** automatically ingests Cloud Audit Logs in real time to identify threat patterns such as anomalous IAM role grants, privilege escalation, and defense evasion. ### Key Advantages - **Automated Governance**: Automatically includes newly provisioned projects without requiring manual logging configurations or individual project pipelines. - **WORM Compliance**: Ensures regulatory compliance (e.g., SEC Rule 17a-4, FINRA, HIPAA) via cryptographic immutability. - **Zero-Latency Ingestion**: Event Threat Detection processes audit streams directly to identify compromised credentials and anomalous grants. ### Why This Is Optimal Alternative approaches that rely on project-level log exports or standard IAM ACLs introduce operational overhead, allow accidental gaps in new projects, and fail to guarantee true immutability against privileged administrative overrides.

Configure Audit Logging Retention Scc Compliance | Professional Cloud Security Engineer

Configure Audit Logging Retention Scc Compliance

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial services organization hosted on Google Cloud must comply with strict regulatory auditability and threat monitoring requirements across all existing and future projects in its resource hierarchy. The compliance and security teams mandate the following requirements:

Capture all Admin Activity and full Data Access audit logs (DATA_READ, DATA_WRITE, and ADMIN_READ) across all services.
Centrally aggregate all audit log entries across the entire resource hierarchy without missing newly created projects.
Store audit logs in an immutable archive for seven years that prevents modification or premature deletion by any identity, including administrators.
Detect threat behaviors in near real-time, such as anomalous IAM role grants and privilege escalation attempts.

Which architecture should the security engineer implement to satisfy these compliance and monitoring requirements?

Enable Cloud Audit Logs at the folder level; create non-aggregated sinks routing to Cloud Logging storage buckets; set retention to 2,555 days; and configure IAM Deny policies preventing the logging.buckets.delete permission for all users and service accounts.

Enable Data Access audit logs for all services in the Organization's default IAM audit configuration; configure an aggregated log sink at the Organization level with includeChildren=true targeting a dedicated Cloud Storage bucket; enforce a 7-year retention policy locked with Bucket Lock; and enable Security Command Center with Event Threat Detection.

Deploy Cloud Service Mesh audit authorization policies across all clusters; configure a central Pub/Sub topic export sink; route events to Cloud Storage using Customer-Managed Encryption Keys (CMEK); and enable Cloud Audit Logs within Google Security Operations SIEM feeds.

Configure Data Access audit logs within each individual project's IAM settings; create standard project-level Cloud Logging sinks exporting to a centralized BigQuery dataset; set a 7-year partition expiration policy; and deploy custom Cloud Functions to parse table rows for anomalous IAM role grants.

Professional Cloud Security Engineer

Configure Audit Logging Retention Scc Compliance

Related questions