An enterprise is deploying automated AI agents built on the Gemini Enterprise Agent Platform. The security operations team needs to establish continuous auditing and threat detection to identify suspicious behavior by agent service account identities. Specifically, the security team must detect: An AI agent attempting reconnaissance by investigating the IAM roles and permissions assigned to its own service account identity. An AI agent making unauthorized cross-project API calls to discover or interact with external resources. Which solution should the security engineer implement to satisfy these requirements?

Enable Security Command Center Event Threat Detection for AI agents, and ensure Cloud Audit Logs (including IAM Data Access logs) are enabled to trigger built-in Agent Runtime control-plane detectors.: ### What Event Threat Detection for AI Agents Is **Security Command Center (SCC) Event Threat Detection (ETD)** provides built-in control-plane threat detectors tailored specifically for AI agents running on the **Gemini Enterprise Agent Platform** and **Agent Runtime**. ETD continuously analyzes **Cloud Audit Logs** (including **Admin Activity** and **IAM Data Access** audit logs) and **Agent Engine Logs** to identify anomalous, malicious, or policy-violating behaviors in near real time. ### How It Meets the Requirements - **Detecting IAM Self-Investigation**: ETD includes the specialized detector `AGENT_ENGINE_IAM_ANOMALOUS_BEHAVIOR_SERVICE_ACCOUNT_GETS_OWN_IAM_POLICY`. This detector evaluates IAM Data Access audit logs (`DATA_READ` permissions) to identify when an identity associated with an AI agent queries and inspects the IAM policies bound to its own service account. - **Detecting Unauthorized Cross-Project API Calls**: ETD provides the detector `AGENT_ENGINE_UNAUTHORIZED_SERVICE_ACCOUNT_API_CALL`, which inspects Admin Activity audit logs to flag instances where an AI agent's service account invokes unauthorized methods against outside Google Cloud projects. ### Key Advantages and Capabilities - **Automated Threat Intelligence**: Predefined AI-specific detectors require no custom regex or log metric scripts. - **Comprehensive AI Lifecycle Coverage**: Detects discovery, privilege escalation, credential access (such as metadata server token fetches), defense evasion, and anomalous IAM grants. - **Actionable Findings**: Generates categorized findings directly in the **Security Command Center Findings Dashboard** with assigned severity levels (**Low** to **High**) and remediation pathways. - **Seamless Integration**: Operates natively alongside **Cloud Logging** and existing enterprise SIEM/SOAR pipelines via Pub/Sub notifications. ### Why This Is Optimal Leveraging native Event Threat Detection eliminates the operational overhead of creating and maintaining custom log parsing rules while delivering purpose-built behavioral analysis designed by Google Cloud for enterprise agentic workloads.

Gemini Agent Threat Detection Audit Logging | Professional Cloud Security Engineer

Gemini Agent Threat Detection Audit Logging

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is deploying automated AI agents built on the Gemini Enterprise Agent Platform. The security operations team needs to establish continuous auditing and threat detection to identify suspicious behavior by agent service account identities.

Specifically, the security team must detect:

An AI agent attempting reconnaissance by investigating the IAM roles and permissions assigned to its own service account identity.
An AI agent making unauthorized cross-project API calls to discover or interact with external resources.

Which solution should the security engineer implement to satisfy these requirements?

Configure Cloud Logging log sinks to route Agent Engine logs to Cloud Data Loss Prevention (Sensitive Data Protection) inspection templates.

Deploy Privileged Access Manager (PAM) and configure an entitlement requiring manual approval for every runtime API call made by the agent.

Configure Dialogflow Console access controls with the Project Viewer role and use Cloud Infrastructure Manager to audit runtime resource drift.

Enable Security Command Center Event Threat Detection for AI agents, and ensure Cloud Audit Logs (including IAM Data Access logs) are enabled to trigger built-in Agent Runtime control-plane detectors.

Professional Cloud Security Engineer

Gemini Agent Threat Detection Audit Logging

Related questions