An enterprise enforces strict Infrastructure-as-Code (IaC) baselines across its entire Google Cloud organization. To minimize the window of exposure caused by out-of-band modifications, the security engineering team must design a continuous drift detection and automated remediation pipeline. The solution must satisfy the following architectural requirements: Capture real-time configuration changes and security posture violations across all organization projects as they occur. Ingest change events into a scalable, decoupled, serverless messaging layer. Trigger automated serverless remediation logic (such as Cloud Functions) to evaluate drift against defined baselines and programmatically revert non-compliant resource attributes. Which architecture should the security team deploy?

Configure Security Command Center (SCC) continuous exports and Cloud Asset Inventory real-time feeds to stream findings and resource state changes to Pub/Sub topics, and trigger Cloud Functions via Pub/Sub subscriptions to execute programmatic remediations.: What the Event-Driven Posture Remediation Architecture Is This architecture combines Security Command Center (SCC) Continuous Exports, Cloud Asset Inventory (CAI) real-time feeds, Cloud Pub/Sub, and Cloud Functions to provide an enterprise-grade, event-driven drift detection and remediation pipeline across a Google Cloud organization. How It Meets the Technical Requirements Real-Time Detection and Streaming: Cloud Asset Inventory feeds notify the system immediately when resource metadata changes occur at the organization level, while SCC Continuous Exports stream high-priority vulnerability and posture findings in real time. Decoupled Serverless Ingestion: Utilizing Cloud Pub/Sub provides a serverless, highly available, and scalable ingestion buffer that decouples event generation from downstream remediation processing and guarantees at-least-once delivery. Programmatic Auto-Remediation: Cloud Functions subscribe to the Pub/Sub topics, parse resource change payloads, compare them against IaC state baselines or organization security policies, and invoke Google Cloud REST APIs to revert unauthorized drifts immediately. Key Advantages and Capabilities Instant Drift Mitigation: Reduces Mean Time to Remediate (MTTR) from hours/days down to seconds without waiting for scheduled batch reconciliation. Scalable Buffering: Pub/Sub retains unacknowledged event notifications for up to 7 days, preventing dropped events during downstream traffic spikes. Organization-Wide Scope: Organization-level feeds and exports capture drift across all current and future folders and projects automatically. Why This Is Optimal Leveraging native Pub/Sub streaming with Cloud Functions creates an asynchronous, event-driven security workflow that operates in sub-second response times without the compute costs, latency, or API quota consumption of continuous batch scanning.

StudyCerts

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Realtime Drift Detection Scc Pubsub Remediation

Section: Managing policy and drift detection at scale (e.g., cloud security posture management, custom organization policies and custom modules for Security Health Analytics).

An enterprise enforces strict Infrastructure-as-Code (IaC) baselines across its entire Google Cloud organization. To minimize the window of exposure caused by out-of-band modifications, the security engineering team must design a continuous drift detection and automated remediation pipeline.

The solution must satisfy the following architectural requirements:

Capture real-time configuration changes and security posture violations across all organization projects as they occur.
Ingest change events into a scalable, decoupled, serverless messaging layer.
Trigger automated serverless remediation logic (such as Cloud Functions) to evaluate drift against defined baselines and programmatically revert non-compliant resource attributes.

Which architecture should the security team deploy?

Enable Compliance Manager in Security Command Center to automatically mute duplicate Security Health Analytics detectors and directly execute automated infrastructure rollbacks natively within the SCC dashboard.

Deploy a Cloud Composer environment that schedules hourly DAGs to execute Terraform plan across all projects, writes drift records to BigQuery, and triggers Cloud Workflows to re-apply Terraform states.

Configure Cloud Audit Logs aggregated log sinks at the organization root routed directly to Cloud Functions HTTP endpoints using Webhooks to parse IAM mutations and rollback drift.

Configure Security Command Center (SCC) continuous exports and Cloud Asset Inventory real-time feeds to stream findings and resource state changes to Pub/Sub topics, and trigger Cloud Functions via Pub/Sub subscriptions to execute programmatic remediations.

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Realtime Drift Detection Scc Pubsub Remediation

Section: Managing policy and drift detection at scale (e.g., cloud security posture management, custom organization policies and custom modules for Security Health Analytics).

The solution must satisfy the following architectural requirements:

Capture real-time configuration changes and security posture violations across all organization projects as they occur.
Ingest change events into a scalable, decoupled, serverless messaging layer.
Trigger automated serverless remediation logic (such as Cloud Functions) to evaluate drift against defined baselines and programmatically revert non-compliant resource attributes.

Which architecture should the security team deploy?

Configure Cloud Audit Logs aggregated log sinks at the organization root routed directly to Cloud Functions HTTP endpoints using Webhooks to parse IAM mutations and rollback drift.

Explanations

What the Event-Driven Posture Remediation Architecture Is

This architecture combines Security Command Center (SCC) Continuous Exports, Cloud Asset Inventory (CAI) real-time feeds, Cloud Pub/Sub, and Cloud Functions to provide an enterprise-grade, event-driven drift detection and remediation pipeline across a Google Cloud organization.

How It Meets the Technical Requirements

Real-Time Detection and Streaming: Cloud Asset Inventory feeds notify the system immediately when resource metadata changes occur at the organization level, while SCC Continuous Exports stream high-priority vulnerability and posture findings in real time.
Decoupled Serverless Ingestion: Utilizing Cloud Pub/Sub provides a serverless, highly available, and scalable ingestion buffer that decouples event generation from downstream remediation processing and guarantees at-least-once delivery.
Programmatic Auto-Remediation: Cloud Functions subscribe to the Pub/Sub topics, parse resource change payloads, compare them against IaC state baselines or organization security policies, and invoke Google Cloud REST APIs to revert unauthorized drifts immediately.

Key Advantages and Capabilities

Instant Drift Mitigation: Reduces Mean Time to Remediate (MTTR) from hours/days down to seconds without waiting for scheduled batch reconciliation.
Scalable Buffering: Pub/Sub retains unacknowledged event notifications for up to 7 days, preventing dropped events during downstream traffic spikes.
Organization-Wide Scope: Organization-level feeds and exports capture drift across all current and future folders and projects automatically.

Why This Is Optimal

Leveraging native Pub/Sub streaming with Cloud Functions creates an asynchronous, event-driven security workflow that operates in sub-second response times without the compute costs, latency, or API quota consumption of continuous batch scanning.

View source documentation

Professional Cloud Security Engineer

Realtime Drift Detection Scc Pubsub Remediation

Professional Cloud Security Engineer

Realtime Drift Detection Scc Pubsub Remediation

What the Event-Driven Posture Remediation Architecture Is

How It Meets the Technical Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions