Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
A security operations team is designing an automated, event-driven incident response pipeline in Google Cloud. When Cloud Audit Logs detect high-risk operations—such as unauthorized service account key creation or a suspicious modification on a Compute Engine instance—the pipeline must immediately execute a 2nd gen Cloud Function to isolate the workload, disable the compromised key, and capture forensic disk snapshots.
Which configuration correctly sets up the event trigger and required IAM permissions to automate this remediation workflow?
roles/cloudfunctions.invoker role to the default Google APIs service agent.Cloud Logging sinks export log entries to supported destinations such as Cloud Storage buckets, BigQuery datasets, Pub/Sub topics, and Log Buckets. Cloud Tasks is a fully managed asynchronous task queue service designed for rate-limiting, queuing, and scheduled execution of background tasks.
roles/run.invoker rather than the legacy roles/cloudfunctions.invoker role on the underlying service.The architecture required rate-limiting, delayed dispatch, or deduplicated queueing of remediation jobs generated by an existing application worker rather than immediate real-time event processing.
roles/pubsub.publisher to the Cloud Run service agent.Cloud Pub/Sub push subscriptions deliver messages as HTTP POST requests to public HTTPS endpoints or authenticated services. The Compute Engine metadata server is an internal, link-local endpoint (http://169.254.169.254/computeMetadata/v1/) accessible only from within a VM instance to retrieve instance metadata, startup scripts, and tokens.
roles/pubsub.publisher to the Cloud Run service agent does not grant the necessary invocation or event reception permissions needed for 2nd gen Cloud Functions.A service inside a VM needed to poll its own local configuration metadata for newly registered custom metadata keys during boot time.
roles/eventarc.eventReceiver and roles/run.invoker roles to the service account used by the trigger.Cloud Functions (2nd gen) runs on top of Cloud Run and uses Eventarc as its underlying event delivery engine. Eventarc captures events from multiple Google Cloud sources—including Cloud Audit Logs, Cloud Storage, and Pub/Sub—and routes them to target destinations formatted as standard CloudEvents.
CreateServiceAccountKey or VM modification API calls).roles/eventarc.eventReceiver role to receive CloudEvent payloads from the event routing layer.roles/run.invoker IAM role on the function's service to authorize HTTP/gRPC invocation requests when an audit event matches the trigger filter.roles/eventarc.eventReceiver, roles/run.invoker) from the runtime permissions required by the function execution identity (such as roles/compute.instanceAdmin or roles/iam.serviceAccountKeyAdmin).Using native Eventarc triggers configured for Cloud Audit Logs removes the architectural need to build and manage custom log sinks, intermediate Pub/Sub topics, or polling daemons. It ensures low-latency event delivery with built-in retry mechanisms and fine-grained IAM authentication.
roles/eventarc.admin role to the default Compute Engine service account.VPC Flow Logs record network traffic samples sent and received by VM network interfaces for network monitoring, forensics, and security analytics. The roles/eventarc.admin IAM role grants administrative control to create, modify, and delete Eventarc triggers and channels across a project.
roles/eventarc.admin provides broad administrative permissions over Eventarc resources instead of the specific operational permissions (roles/eventarc.eventReceiver and roles/run.invoker) needed for event routing and function execution.roles/eventarc.eventReceiver to ingest events and roles/run.invoker on the destination service.The objective was to grant an infrastructure engineer full administrative privileges to manage Eventarc configurations and triggers across an entire project.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated