An enterprise enforces strict Infrastructure-as-Code (IaC) baselines across its entire Google Cloud organization. To minimize the window of exposure caused by out-of-band modifications, the security engineering team must design a continuous drift detection and automated remediation pipeline. The solution must satisfy the following architectural requirements: Capture real-time configuration changes and security posture violations across all organization projects as they occur. Ingest change events into a scalable, decoupled, serverless messaging layer. Trigger automated serverless remediation logic (such as Cloud Functions) to evaluate drift against defined baselines and programmatically revert non-compliant resource attributes. Which architecture should the security team deploy?

Configure Security Command Center (SCC) continuous exports and Cloud Asset Inventory real-time feeds to stream findings and resource state changes to Pub/Sub topics, and trigger Cloud Functions via Pub/Sub subscriptions to execute programmatic remediations.: ### What the Event-Driven Posture Remediation Architecture Is This architecture combines **Security Command Center (SCC) Continuous Exports**, **Cloud Asset Inventory (CAI) real-time feeds**, **Cloud Pub/Sub**, and **Cloud Functions** to provide an enterprise-grade, event-driven drift detection and remediation pipeline across a Google Cloud organization. ### How It Meets the Technical Requirements - **Real-Time Detection and Streaming**: Cloud Asset Inventory feeds notify the system immediately when resource metadata changes occur at the organization level, while SCC Continuous Exports stream high-priority vulnerability and posture findings in real time. - **Decoupled Serverless Ingestion**: Utilizing **Cloud Pub/Sub** provides a serverless, highly available, and scalable ingestion buffer that decouples event generation from downstream remediation processing and guarantees at-least-once delivery. - **Programmatic Auto-Remediation**: Cloud Functions subscribe to the Pub/Sub topics, parse resource change payloads, compare them against IaC state baselines or organization security policies, and invoke Google Cloud REST APIs to revert unauthorized drifts immediately. ### Key Advantages and Capabilities - **Instant Drift Mitigation**: Reduces Mean Time to Remediate (MTTR) from hours/days down to seconds without waiting for scheduled batch reconciliation. - **Scalable Buffering**: Pub/Sub retains unacknowledged event notifications for up to 7 days, preventing dropped events during downstream traffic spikes. - **Organization-Wide Scope**: Organization-level feeds and exports capture drift across all current and future folders and projects automatically. ### Why This Is Optimal Leveraging native Pub/Sub streaming with Cloud Functions creates an asynchronous, event-driven security workflow that operates in sub-second response times without the compute costs, latency, or API quota consumption of continuous batch scanning.

Realtime Drift Detection Scc Pubsub Remediation | Professional Cloud Security Engineer

Realtime Drift Detection Scc Pubsub Remediation

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise enforces strict Infrastructure-as-Code (IaC) baselines across its entire Google Cloud organization. To minimize the window of exposure caused by out-of-band modifications, the security engineering team must design a continuous drift detection and automated remediation pipeline.

The solution must satisfy the following architectural requirements:

Capture real-time configuration changes and security posture violations across all organization projects as they occur.
Ingest change events into a scalable, decoupled, serverless messaging layer.
Trigger automated serverless remediation logic (such as Cloud Functions) to evaluate drift against defined baselines and programmatically revert non-compliant resource attributes.

Which architecture should the security team deploy?

Deploy a Cloud Composer environment that schedules hourly DAGs to execute Terraform plan across all projects, writes drift records to BigQuery, and triggers Cloud Workflows to re-apply Terraform states.

Enable Compliance Manager in Security Command Center to automatically mute duplicate Security Health Analytics detectors and directly execute automated infrastructure rollbacks natively within the SCC dashboard.

Configure Cloud Audit Logs aggregated log sinks at the organization root routed directly to Cloud Functions HTTP endpoints using Webhooks to parse IAM mutations and rollback drift.

Configure Security Command Center (SCC) continuous exports and Cloud Asset Inventory real-time feeds to stream findings and resource state changes to Pub/Sub topics, and trigger Cloud Functions via Pub/Sub subscriptions to execute programmatic remediations.

Professional Cloud Security Engineer

Realtime Drift Detection Scc Pubsub Remediation

Related questions