A financial services organization hosted on Google Cloud must comply with strict regulatory auditability and threat monitoring requirements across all existing and future projects in its resource hierarchy. The compliance and security teams mandate the following requirements: Capture all Admin Activity and full Data Access audit logs (DATA_READ, DATA_WRITE, and ADMIN_READ) across all services. Centrally aggregate all audit log entries across the entire resource hierarchy without missing newly created projects. Store audit logs in an immutable archive for seven years that prevents modification or premature deletion by any identity, including administrators. Detect threat behaviors in near real-time, such as anomalous IAM role grants and privilege escalation attempts. Which architecture should the security engineer implement to satisfy these compliance and monitoring requirements?

Enable Data Access audit logs for all services in the Organization's default IAM audit configuration; configure an aggregated log sink at the Organization level with `includeChildren=true` targeting a dedicated Cloud Storage bucket; enforce a 7-year retention policy locked with Bucket Lock; and enable Security Command Center with Event Threat Detection.: What the Solution Is This architecture establishes a centralized, organization-wide logging, immutable retention, and automated threat detection framework using Google Cloud native compliance controls. How It Meets the Requirements Comprehensive Audit Coverage: Configuring the default audit configuration at the root Organization level enables DATA_READ, DATA_WRITE, and ADMIN_READ log types across all services and child resources. Admin Activity logs are enabled by default. Central Aggregation: Deploying an aggregated log sink at the Organization level with includeChildren=true intercepts and routes all audit log entries from all current and future folders and projects into a centralized compliance destination. Immutable Retention: Applying a 7-year retention policy to a dedicated Cloud Storage bucket and securing it with Bucket Lock enforces Write-Once-Read-Many (WORM) storage. Once locked, the retention policy cannot be removed, reduced, or bypassed by any principal or administrator. Threat Detection: Security Command Center (SCC) with Event Threat Detection automatically ingests Cloud Audit Logs in real time to identify threat patterns such as anomalous IAM role grants, privilege escalation, and defense evasion. Key Advantages Automated Governance: Automatically includes newly provisioned projects without requiring manual logging configurations or individual project pipelines. WORM Compliance: Ensures regulatory compliance (e.g., SEC Rule 17a-4, FINRA, HIPAA) via cryptographic immutability. Zero-Latency Ingestion: Event Threat Detection processes audit streams directly to identify compromised credentials and anomalous grants. Why This Is Optimal Alternative approaches that rely on project-level log exports or standard IAM ACLs introduce operational overhead, allow accidental gaps in new projects, and fail to guarantee true immutability against privileged administrative overrides.

Configure Audit Logging Retention Scc Compliance | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

A financial enterprise is subject to strict regulatory compliance mandates governing data residency, cryptographic boundary isolation, and access governance. The security team needs to enforce the following controls across their Google Cloud environment: Ensure that data analytics and storage services cannot provision unencrypted or default-encrypted resources. Restrict all Customer-Managed Encryption Keys (CMEK) to originate strictly from key rings located in authorized regulatory regions within a dedicated KMS host project. Maintain least privilege access by granting encryption/decryption capabilities only to the necessary Google-managed service identities. Which combination of controls and Organization Policies should the enterprise implement?

Mapping compliance requirements to Google Cloud services and security controls (e.g., network and access segmentation, audit log coverage).

AdvancedProfessional Cloud Security Engineer

An enterprise is designing a Cardholder Data Environment (CDE) on Google Cloud to meet stringent PCI-DSS and FedRAMP network segmentation and perimeter defense mandates. The architecture deploys a Shared VPC host project for centralized network management alongside multiple service projects hosting compute workloads, Cloud Build private pools, and Cloud Storage buckets containing sensitive cardholder data. Which architectural requirement must be implemented to enforce the VPC Service Controls boundary across this infrastructure without breaking communication?

Mapping compliance requirements to Google Cloud services and security controls (e.g., network and access segmentation, audit log coverage).

AdvancedProfessional Cloud Security Engineer

An enterprise manages multiple database workloads across several projects located inside a single folder named Application-Services. The security team needs to grant members of the database administration team permissions to inspect and configure Cloud SQL instances across all current and future projects in this folder. The access control architecture must satisfy the following constraints: Administrators must be able to view instance configuration details and navigate Cloud SQL resources seamlessly within the Google Cloud console. Administrators must NOT have permission to delete instances, delete databases, or modify IAM policy bindings. Administrators must NOT receive read or write permissions to any non-database services in the projects. What should the security engineer do to enforce the principle of least privilege?

Defining access control at the organization, folder, project, and resource level using the principle of least privilege.

AdvancedProfessional Cloud Security Engineer

An enterprise organization is establishing a centralized Shared VPC architecture to host workloads across multiple departments. The central network security team manages the Shared VPC host project, which contains subnet-frontend (in us-central1), subnet-backend (in us-central1), and subnet-analytics (in us-east1). The organization must meet the following access and administrative requirements: The AppDev team manages instances in service-project-app and must only be able to provision VM instances into subnet-frontend. The Analytics team manages instances in service-project-data and must only be able to provision VM instances into subnet-analytics. Neither team should have access or provisioning rights to the remaining subnets in the Shared VPC. Central network administrators must retain exclusive control over network creation, firewall rules, and subnet routing without administering VM instances. How should IAM roles and resource bindings be configured to meet these requirements following the principle of least privilege?

Configuring security properties of a VPC network, VPC peering, Shared VPC, and firewall rules.

AdvancedProfessional Cloud Security Engineer

An enterprise is establishing a data governance and encryption framework on Google Cloud to comply with strict regional data sovereignty and regulatory standards. The compliance baseline dictates the following technical requirements: All regional service data must be encrypted using Customer-Managed Encryption Keys (CMEK) protected by hardware security modules (Cloud HSM). Key management must enforce strict separation of duties between key custodians and application resource administrators. Key rotation must occur periodically such that newly written data uses the latest cryptographic key version while existing historical data remains continuously decryptable without data loss. Which Cloud KMS configuration and lifecycle management strategy should the security architect specify?

Determining technical needs relative to compute, data, network, and storage.

FundamentalAssociate Data Practitioner

Cloud Storage Regional Location

Choose the appropriate data storage location type (e.g., regional, dual-regional, multi-regional, zonal)

Professional Cloud Security Engineer

Configure Audit Logging Retention Scc Compliance

Related questions

Cloud Storage Regional Location

Professional Cloud Security Engineer

Configure Audit Logging Retention Scc Compliance

What the Solution Is

How It Meets the Requirements

Key Advantages

Why This Is Optimal

Related questions

Cloud Storage Regional Location

What the Solution Is

How It Meets the Requirements

Key Advantages

Why This Is Optimal