A multinational enterprise is hardening its Google Cloud environment against identity compromise and unauthorized privilege escalation. The security operations team identified that attackers might attempt to chain service account impersonations or exploit dormant and default service accounts to perform unauthorized administrative actions. The team needs to establish a comprehensive strategy to meet the following requirements: Automatically monitor and detect anomalous multi-step service account delegation and sensitive role grants to dormant service accounts using Cloud Audit Logs. Prevent the generation and exfiltration of persistent, user-managed service account credentials across all projects in the organization hierarchy. Investigate anomalous delegation chains and identify over-privileged accounts for remediation. Which combination of controls and tools should the security engineer implement?

Enable Security Command Center Event Threat Detection to analyze Admin Activity audit logs for anomalous delegation and dormant account role assignments, enforce the iam.disableServiceAccountKeyCreation organization policy constraint, and use IAM Recommender alongside finding details to remediate excessive permissions.: What this solution is This solution combines Security Command Center (SCC) Event Threat Detection (ETD), Google Cloud Organization Policy Service, and IAM Recommender to establish end-to-end detection, prevention, and remediation for service account security. How it meets the requirements Automated threat detection: Event Threat Detection automatically ingests and evaluates IAM Admin Activity audit logs to uncover threats such as Privilege Escalation: Anomalous Multistep Service Account Delegation for Admin Activity and Privilege Escalation: Impersonation Role Granted for Dormant Service Account. It analyzes the delegation chain, identifying the initial caller and intermediary impersonated principals. Preventing credential exfiltration: Enforcing the organizational policy constraint iam.disableServiceAccountKeyCreation at the organization root blocks users and automation pipelines from generating user-managed private key files (.json), forcing workloads to use secure, short-lived tokens and workload identity federation. Investigation and remediation: When findings trigger, the finding details reveal the Principal email, Service account delegation information, and Cloud Logging URI to facilitate triage. Security teams can then leverage IAM Recommender to detect over-privileged or unused permissions on target service accounts and safely downscope access. Key advantages and capabilities Deep delegation visibility: Unpacks nested impersonation hops to expose the true originating caller attempting privilege escalation. Proactive risk reduction: Eliminates long-lived static service account keys, neutralizing credential leakage vectors. Native log processing: Requires no external log shipping infrastructure or custom parsing rules for standard threat categories. Least-privilege enforcement: Couples threat alerting with automated role recommendation insights to remove dormant or excessive grants. Why this is optimal This approach directly aligns with Google Cloud security best practices by pairing preventive guardrails (Organization Policies) with continuous runtime threat detection (SCC Event Threat Detection) and intelligent rightsizing (IAM Recommender).

StudyCerts

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Scc Service Account Threat Detection Policies

Section: Securing and protecting service accounts (including default service accounts).

A multinational enterprise is hardening its Google Cloud environment against identity compromise and unauthorized privilege escalation. The security operations team identified that attackers might attempt to chain service account impersonations or exploit dormant and default service accounts to perform unauthorized administrative actions. The team needs to establish a comprehensive strategy to meet the following requirements:

Automatically monitor and detect anomalous multi-step service account delegation and sensitive role grants to dormant service accounts using Cloud Audit Logs.
Prevent the generation and exfiltration of persistent, user-managed service account credentials across all projects in the organization hierarchy.
Investigate anomalous delegation chains and identify over-privileged accounts for remediation.

Which combination of controls and tools should the security engineer implement?

Deploy Web Security Scanner to crawl IAM API endpoints for delegation vulnerabilities, configure VPC Service Controls perimeters around the IAM API, and use OS Login 2-step verification to block service account key downloads.

Enable Security Command Center Event Threat Detection to analyze Admin Activity audit logs for anomalous delegation and dormant account role assignments, enforce the iam.disableServiceAccountKeyCreation organization policy constraint, and use IAM Recommender alongside finding details to remediate excessive permissions.

Create Cloud Logging exclusion sinks to filter out IAM Admin Activity logs, grant developers the Service Account Key Admin role with IAM conditions, and deploy Chronicle SOAR playbooks to automatically disable the Google APIs Service Agent.

Configure VPC Flow Logs with Cloud IDS to inspect IAM token delegation payloads, enforce the constraints/gcp.restrictNonCmekServices organization policy constraint, and write custom Cloud Functions to delete service accounts inactive for 30 days.

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Scc Service Account Threat Detection Policies

Section: Securing and protecting service accounts (including default service accounts).

Automatically monitor and detect anomalous multi-step service account delegation and sensitive role grants to dormant service accounts using Cloud Audit Logs.
Prevent the generation and exfiltration of persistent, user-managed service account credentials across all projects in the organization hierarchy.
Investigate anomalous delegation chains and identify over-privileged accounts for remediation.

Which combination of controls and tools should the security engineer implement?

Explanations

What this solution is

This solution combines Security Command Center (SCC) Event Threat Detection (ETD), Google Cloud Organization Policy Service, and IAM Recommender to establish end-to-end detection, prevention, and remediation for service account security.

How it meets the requirements

Automated threat detection: Event Threat Detection automatically ingests and evaluates IAM Admin Activity audit logs to uncover threats such as Privilege Escalation: Anomalous Multistep Service Account Delegation for Admin Activity and Privilege Escalation: Impersonation Role Granted for Dormant Service Account. It analyzes the delegation chain, identifying the initial caller and intermediary impersonated principals.
Preventing credential exfiltration: Enforcing the organizational policy constraint iam.disableServiceAccountKeyCreation at the organization root blocks users and automation pipelines from generating user-managed private key files (.json), forcing workloads to use secure, short-lived tokens and workload identity federation.
Investigation and remediation: When findings trigger, the finding details reveal the Principal email, Service account delegation information, and Cloud Logging URI to facilitate triage. Security teams can then leverage IAM Recommender to detect over-privileged or unused permissions on target service accounts and safely downscope access.

Key advantages and capabilities

Deep delegation visibility: Unpacks nested impersonation hops to expose the true originating caller attempting privilege escalation.
Proactive risk reduction: Eliminates long-lived static service account keys, neutralizing credential leakage vectors.
Native log processing: Requires no external log shipping infrastructure or custom parsing rules for standard threat categories.
Least-privilege enforcement: Couples threat alerting with automated role recommendation insights to remove dormant or excessive grants.

Why this is optimal

This approach directly aligns with Google Cloud security best practices by pairing preventive guardrails (Organization Policies) with continuous runtime threat detection (SCC Event Threat Detection) and intelligent rightsizing (IAM Recommender).

View source documentation

Professional Cloud Security Engineer

Scc Service Account Threat Detection Policies

Professional Cloud Security Engineer

Scc Service Account Threat Detection Policies

What this solution is

How it meets the requirements

Key advantages and capabilities

Why this is optimal

Related questions

BigQuery QUALIFY, COALESCE, SAFE.PARSE_DATE