Configure Authorization Policy Dry Run Logging

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is rolling out strict service authorization policies for containerized microservices deployed across a Google Cloud environment. Before transitioning the policies to active blocking enforcement, the security team must evaluate the impact of a new denial policy against live production traffic to verify that legitimate services are not inadvertently blocked. Furthermore, the team needs to audit and inspect the simulated policy evaluation outcomes within Cloud Logging.

Which configuration should the security engineer implement to evaluate the policy safely without interrupting traffic?

Configure traffic bypass annotations such as excludeInboundPorts on the Pods and verify packet metrics in Cloud Monitoring.

Apply the authorization policy with the annotation "istio.io/dry-run": "true" and query Cloud Logging for records containing labels.dry_run_result="AuthzDenied".

Disable sidecar injection across the target workloads using the label sidecar.istio.io/inject="false" and monitor GKE Admin Activity audit logs.

Apply the organization policy constraint constraints/gcp.restrictCmekCryptoKeyProjects and inspect Cloud KMS audit logs for key access.

Professional Cloud Security Engineer

Configure Authorization Policy Dry Run Logging

Related questions