A multinational enterprise is hardening its Google Cloud environment against identity compromise and unauthorized privilege escalation. The security operations team identified that attackers might attempt to chain service account impersonations or exploit dormant and default service accounts to perform unauthorized administrative actions. The team needs to establish a comprehensive strategy to meet the following requirements: Automatically monitor and detect anomalous multi-step service account delegation and sensitive role grants to dormant service accounts using Cloud Audit Logs. Prevent the generation and exfiltration of persistent, user-managed service account credentials across all projects in the organization hierarchy. Investigate anomalous delegation chains and identify over-privileged accounts for remediation. Which combination of controls and tools should the security engineer implement?

Enable Security Command Center Event Threat Detection to analyze Admin Activity audit logs for anomalous delegation and dormant account role assignments, enforce the iam.disableServiceAccountKeyCreation organization policy constraint, and use IAM Recommender alongside finding details to remediate excessive permissions.: ### What this solution is This solution combines **Security Command Center (SCC) Event Threat Detection (ETD)**, Google Cloud **Organization Policy Service**, and **IAM Recommender** to establish end-to-end detection, prevention, and remediation for service account security. ### How it meets the requirements - **Automated threat detection**: **Event Threat Detection** automatically ingests and evaluates **IAM Admin Activity audit logs** to uncover threats such as `Privilege Escalation: Anomalous Multistep Service Account Delegation for Admin Activity` and `Privilege Escalation: Impersonation Role Granted for Dormant Service Account`. It analyzes the delegation chain, identifying the initial caller and intermediary impersonated principals. - **Preventing credential exfiltration**: Enforcing the organizational policy constraint `iam.disableServiceAccountKeyCreation` at the organization root blocks users and automation pipelines from generating user-managed private key files (`.json`), forcing workloads to use secure, short-lived tokens and workload identity federation. - **Investigation and remediation**: When findings trigger, the finding details reveal the **Principal email**, **Service account delegation information**, and **Cloud Logging URI** to facilitate triage. Security teams can then leverage **IAM Recommender** to detect over-privileged or unused permissions on target service accounts and safely downscope access. ### Key advantages and capabilities - **Deep delegation visibility**: Unpacks nested impersonation hops to expose the true originating caller attempting privilege escalation. - **Proactive risk reduction**: Eliminates long-lived static service account keys, neutralizing credential leakage vectors. - **Native log processing**: Requires no external log shipping infrastructure or custom parsing rules for standard threat categories. - **Least-privilege enforcement**: Couples threat alerting with automated role recommendation insights to remove dormant or excessive grants. ### Why this is optimal This approach directly aligns with Google Cloud security best practices by pairing preventive guardrails (Organization Policies) with continuous runtime threat detection (SCC Event Threat Detection) and intelligent rightsizing (IAM Recommender).

Scc Service Account Threat Detection Policies | Professional Cloud Security Engineer

Scc Service Account Threat Detection Policies

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A multinational enterprise is hardening its Google Cloud environment against identity compromise and unauthorized privilege escalation. The security operations team identified that attackers might attempt to chain service account impersonations or exploit dormant and default service accounts to perform unauthorized administrative actions. The team needs to establish a comprehensive strategy to meet the following requirements:

Automatically monitor and detect anomalous multi-step service account delegation and sensitive role grants to dormant service accounts using Cloud Audit Logs.
Prevent the generation and exfiltration of persistent, user-managed service account credentials across all projects in the organization hierarchy.
Investigate anomalous delegation chains and identify over-privileged accounts for remediation.

Which combination of controls and tools should the security engineer implement?

Deploy Web Security Scanner to crawl IAM API endpoints for delegation vulnerabilities, configure VPC Service Controls perimeters around the IAM API, and use OS Login 2-step verification to block service account key downloads.

Enable Security Command Center Event Threat Detection to analyze Admin Activity audit logs for anomalous delegation and dormant account role assignments, enforce the iam.disableServiceAccountKeyCreation organization policy constraint, and use IAM Recommender alongside finding details to remediate excessive permissions.

Create Cloud Logging exclusion sinks to filter out IAM Admin Activity logs, grant developers the Service Account Key Admin role with IAM conditions, and deploy Chronicle SOAR playbooks to automatically disable the Google APIs Service Agent.

Configure VPC Flow Logs with Cloud IDS to inspect IAM token delegation payloads, enforce the constraints/gcp.restrictNonCmekServices organization policy constraint, and write custom Cloud Functions to delete service accounts inactive for 30 days.

Professional Cloud Security Engineer

Scc Service Account Threat Detection Policies

Related questions