Secure Log Export Cmek Vpcsc

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization is designing an automated pipeline to route audit logs from multiple production projects to a centralized Cloud Storage bucket in a dedicated security project. The exported logs must be encrypted at rest using Customer-Managed Encryption Keys (CMEK) and protected against data exfiltration using VPC Service Controls.

Which set of actions should the security engineer take to implement this pipeline following the principle of least privilege?

Create the log sink, grant roles/storage.objectViewer to the sink's writer identity on the bucket, grant roles/cloudkms.cryptoKeyEncrypterDecrypter directly to the sink's writer identity on the CMEK key, and configure an Istio egress gateway on GKE.

Create the log sink, grant roles/storage.admin to the project's default Compute Engine service account on the bucket, grant roles/cloudkms.admin to the Log Router service account on the CMEK key, and create a Cloud NAT gateway inside the perimeter.

Create the log sink with a dedicated writer identity, grant roles/storage.objectCreator to the sink's writer identity on the bucket, grant roles/cloudkms.cryptoKeyEncrypterDecrypter to the Cloud Storage service agent on the CMEK key, and include the source and destination projects along with Cloud Storage and Cloud KMS in the VPC Service Controls perimeter.

Create the log sink with the --use-partitioned-tables flag, grant roles/storage.objectAdmin to the Cloud Logging service agent on the bucket, and disable default encryption on the destination storage bucket.

Professional Cloud Security Engineer

Secure Log Export Cmek Vpcsc

Related questions