Scc Owner Not Monitored Log Metric Alert

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise security operations team is configuring continuous threat detection and alerting across their Google Cloud environment to satisfy CIS Google Cloud Computing Platform Benchmark controls. During an audit, Security Command Center (SCC) generates an active OWNER_NOT_MONITORED compliance and security finding across several production projects.

Which configuration must the team implement to continuously monitor unauthorized project ownership modifications and resolve this finding?

Enable the Event Threat Detection module in Security Command Center and configure an automated Cloud Functions webhook triggered on DEFENSE_EVASION_MODIFY_VPC_SERVICE_CONTROL.

Deploy an organization-level log sink that routes all IAM Admin Activity logs to BigQuery, and execute scheduled SQL queries every hour to detect new owner bindings.

Configure a Cloud Monitoring uptime check targeting the Cloud Resource Manager API endpoint, and set up an alert policy that fires when API availability drops below 99.9%.

Create a logs-based counter metric in Cloud Logging filtering on Cloud Resource Manager audit logs for additions or removals of the roles/owner IAM role, and configure a Cloud Monitoring alert policy with assigned notification channels.

Professional Cloud Security Engineer

Scc Owner Not Monitored Log Metric Alert

Related questions