Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An enterprise security operations team is configuring continuous threat detection and alerting across their Google Cloud environment to satisfy CIS Google Cloud Computing Platform Benchmark controls. During an audit, Security Command Center (SCC) generates an active OWNER_NOT_MONITORED compliance and security finding across several production projects.
Which configuration must the team implement to continuously monitor unauthorized project ownership modifications and resolve this finding?
Enable the Event Threat Detection module in Security Command Center and configure an automated Cloud Functions webhook triggered on DEFENSE_EVASION_MODIFY_VPC_SERVICE_CONTROL.
Create a logs-based counter metric in Cloud Logging filtering on Cloud Resource Manager audit logs for additions or removals of the roles/owner IAM role, and configure a Cloud Monitoring alert policy with assigned notification channels.
Deploy an organization-level log sink that routes all IAM Admin Activity logs to BigQuery, and execute scheduled SQL queries every hour to detect new owner bindings.
Configure a Cloud Monitoring uptime check targeting the Cloud Resource Manager API endpoint, and set up an alert policy that fires when API availability drops below 99.9%.
Enable the Event Threat Detection module in Security Command Center and configure an automated Cloud Functions webhook triggered on DEFENSE_EVASION_MODIFY_VPC_SERVICE_CONTROL.
Create a logs-based counter metric in Cloud Logging filtering on Cloud Resource Manager audit logs for additions or removals of the roles/owner IAM role, and configure a Cloud Monitoring alert policy with assigned notification channels.
Creating a logs-based counter metric coupled with a Cloud Monitoring alert policy establishes continuous, real-time detection for changes made to administrative permissions. It specifically tracks modifications to project-level ownership roles recorded in Cloud Audit Logs.
StudyCerts
StudyCertsSetIamPolicy calls handled by cloudresourcemanager.googleapis.com. By filtering for protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner" where the action is ADD or REMOVE (as well as ProjectOwnership or projectOwnerInvitee), any grant or revocation of ownership immediately increments the metric.OWNER_NOT_MONITORED finding: Security Command Center's Security Health Analytics detector checks that the project contains a LogsMetric resource with this exact Cloud Resource Manager filter and verifies that an associated alertPolicy exists with active conditions and notificationChannels.This architecture leverages built-in Google Cloud Observability and Security Command Center mechanisms. It requires no third-party software, eliminates batch polling delays, and natively satisfies CIS compliance auditing algorithms.
Deploy an organization-level log sink that routes all IAM Admin Activity logs to BigQuery, and execute scheduled SQL queries every hour to detect new owner bindings.
Configure a Cloud Monitoring uptime check targeting the Cloud Resource Manager API endpoint, and set up an alert policy that fires when API availability drops below 99.9%.