Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
A security operations team is investigating an incident triggered by an Event Threat Detection finding: Privilege Escalation: Anomalous Multistep Service Account Delegation for Admin Activity.
While analyzing the raw Google Cloud Admin Activity audit log entry associated with the incident in Cloud Logging, the analyst observes the following authenticationInfo and requestMetadata structure:
StudyCerts
StudyCerts{
"protoPayload": {
"serviceName": "storage.googleapis.com",
"methodName": "storage.buckets.setIamPolicy",
"authenticationInfo": {
"principalEmail": "prod-backup-manager@company-prod.iam.gserviceaccount.com",
"serviceAccountDelegationInfo": [
{
"principalEmail": "cicd-deployer@company-prod.iam.gserviceaccount.com"
},
{
"principalEmail": "external-contractor@partner.com"
}
]
},
"requestMetadata": {
"callerIp": "198.51.100.24"
}
}
}
How should the security analyst interpret the identity hierarchy and audit fields to reconstruct this security event?
In Google Cloud Audit Logs, when API calls are executed using service account impersonation or delegation chains, the protoPayload.authenticationInfo object records both the direct identity whose privileges were evaluated and the sequence of identities that delegated those privileges.
principalEmail): The top-level principalEmail field (prod-backup-manager@company-prod.iam.gserviceaccount.com) records the final service account whose IAM permissions authorized the storage.buckets.setIamPolicy method.serviceAccountDelegationInfo bottom): In multi-step delegation chains, the entries in serviceAccountDelegationInfo describe the delegation sequence in reverse order; the principal at the bottom (the last element of the list, external-contractor@partner.com) is the originating actor who initiated the impersonation sequence.cicd-deployer@company-prod.iam.gserviceaccount.com) represent intermediate service accounts whose credentials or tokens were generated along the transitive delegation chain.external-contractor@partner.com is the initial identity requiring credential revocation and compromise assessment.iam.serviceAccounts.getAccessToken or roles/iam.serviceAccountTokenCreator) spanning from external-contractor through cicd-deployer to prod-backup-manager.198.51.100.24 back to the external entity that originated the request.Understanding the ordering within serviceAccountDelegationInfo ensures investigators do not misattribute malicious changes solely to the service account executing the API call, enabling full remediation of the compromised originating identity and intermediate privilege escalation vectors.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.