Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
A security operations team is designing an automated, event-driven incident response pipeline in Google Cloud. When Cloud Audit Logs detect high-risk operations—such as unauthorized service account key creation or a suspicious modification on a Compute Engine instance—the pipeline must immediately execute a 2nd gen Cloud Function to isolate the workload, disable the compromised key, and capture forensic disk snapshots.
Which configuration correctly sets up the event trigger and required IAM permissions to automate this remediation workflow?
Create a Cloud Logging sink routed directly to Cloud Tasks, and assign the roles/cloudfunctions.invoker role to the default Google APIs service agent.
Configure a Cloud Pub/Sub push subscription targeting the Compute Engine metadata server, and grant roles/pubsub.publisher to the Cloud Run service agent.
Configure an Eventarc trigger routed through VPC Flow Logs, and grant the roles/eventarc.admin role to the default Compute Engine service account.
Configure an Eventarc trigger filtered on Cloud Audit Log events, and assign the roles/eventarc.eventReceiver and roles/run.invoker roles to the service account used by the trigger.
Cloud Functions (2nd gen) runs on top of Cloud Run and uses Eventarc as its underlying event delivery engine. Eventarc captures events from multiple Google Cloud sources—including Cloud Audit Logs, Cloud Storage, and Pub/Sub—and routes them to target destinations formatted as standard CloudEvents.
StudyCerts
StudyCertsCreateServiceAccountKey or VM modification API calls).roles/eventarc.eventReceiver role to receive CloudEvent payloads from the event routing layer.roles/run.invoker IAM role on the function's service to authorize HTTP/gRPC invocation requests when an audit event matches the trigger filter.roles/eventarc.eventReceiver, roles/run.invoker) from the runtime permissions required by the function execution identity (such as roles/compute.instanceAdmin or roles/iam.serviceAccountKeyAdmin).Using native Eventarc triggers configured for Cloud Audit Logs removes the architectural need to build and manage custom log sinks, intermediate Pub/Sub topics, or polling daemons. It ensures low-latency event delivery with built-in retry mechanisms and fine-grained IAM authentication.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Still curious? Scout, our AI tutor, can explain this concept further and answer your follow-up questions.