Eventarc Cloud Function Incident Response Remediation

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security operations team is designing an automated, event-driven incident response pipeline in Google Cloud. When Cloud Audit Logs detect high-risk operations—such as unauthorized service account key creation or a suspicious modification on a Compute Engine instance—the pipeline must immediately execute a 2nd gen Cloud Function to isolate the workload, disable the compromised key, and capture forensic disk snapshots.

Which configuration correctly sets up the event trigger and required IAM permissions to automate this remediation workflow?

Configure a Cloud Pub/Sub push subscription targeting the Compute Engine metadata server, and grant roles/pubsub.publisher to the Cloud Run service agent.

Configure an Eventarc trigger filtered on Cloud Audit Log events, and assign the roles/eventarc.eventReceiver and roles/run.invoker roles to the service account used by the trigger.

Configure an Eventarc trigger routed through VPC Flow Logs, and grant the roles/eventarc.admin role to the default Compute Engine service account.

Create a Cloud Logging sink routed directly to Cloud Tasks, and assign the roles/cloudfunctions.invoker role to the default Google APIs service agent.

Professional Cloud Security Engineer

Eventarc Cloud Function Incident Response Remediation

Related questions