Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Cloud Audit Logs (Admin Activity, Data Access, and Policy Denied) flow from projects into an aggregated log sink at the organization or folder level. The sink exports logs to BigQuery for security analysis and to Cloud Storage for immutable long-term archives, and both destinations feed Security Command Center and Google Security Operations to detect threats while keeping the audit trail tamper-proof.
Admin Activity logs are always enabled and capture actions that modify configurations, whereas Data Access logs record actions that read or write data and must be turned on manually. Furthermore, enabling Data Access logs at the organization or folder level ensures that all projects within that hierarchy are covered.
Aggregated log sinks created at the organization or folder level route logs to central, durable destinations like BigQuery for analysis or Cloud Storage for cheap, unchangeable archives. This centralized architecture stops individual project administrators from altering or deleting the audit trail, ensuring the records remain reliable for official compliance audits.
VPC Service Controls create security perimeters around groups of services and data to satisfy strict network segmentation requirements. These perimeters prevent data from being copied outside the defined boundary and simultaneously block external attackers from accessing the resources located inside.
Assured Workloads provides pre-packaged settings that automatically configure data residency, enforce Customer-Managed Encryption Keys (CMEK), and establish network perimeters using VPC Service Controls. This combines identity, encryption, network, and logging controls into a unified, verifiable architecture that directly meets regulatory mandates.
Cloud Audit Logs are the foundation for proving compliance in Google Cloud. There are three main log types. Admin Activity logs are always on and record actions that change configurations. Data Access logs record actions that read or write data and must be turned on manually; enabling them at the organization or folder level ensures all projects are covered. Policy Denied logs capture failed access attempts, showing when a security rule blocked a request, which is crucial for verifying security perimeters.
To meet long-term retention rules, you must centralize these logs. You create aggregated log sinks at the organization or folder level. These sinks send logs to durable storage like BigQuery for analysis or Cloud Storage for cheap, unchangeable archives. This central setup stops individual project admins from deleting or altering the audit trail, guaranteeing the logs can be trusted for official compliance checks.
These logs feed into security monitoring tools. Security Command Center (SCC) and Google Security Operations use the logs to spot threats automatically. For example, they can detect unusual permission grants, changes to security perimeters, or signs of stolen credentials. By sending these alerts to a security dashboard, teams can respond quickly to incidents and maintain continuous compliance.
Network isolation means creating clear boundaries to control traffic and protect data. Google Cloud uses a layered, zero-trust approach, assuming threats can come from anywhere. Key services work together to build these secure perimeters, helping meet standards like PCI-DSS.
VPC Service Controls create security perimeters around groups of services and data. They stop data from being copied out of the perimeter and block external attackers from reaching resources inside. This is a primary defense against data theft and is essential for strict network segmentation requirements.
For workloads, using private clusters (which have no public IPs) reduces attack points. Combining this with VPC Service Controls locks down external access even further. To protect against large-scale attacks, Cloud Armor defends against network and application-layer attacks, acting as a smart firewall for your services.
Inside a cluster, Kubernetes Network Policies control traffic between pods, adding another layer of segmentation. These policies, along with VPC firewall rules, ensure only authorized communication happens, creating a defense-in-depth strategy that satisfies regulatory mandates for network isolation.
Regulations often demand strict control over who can access data and where that data lives. Mapping these requirements involves using specific Google Cloud controls together. The core idea is least privilege—giving only the minimum access needed.
For identity governance, IAM Conditions add extra rules to permissions, like only allowing access from a corporate office IP address. Tools like IAM Recommender help find and fix permissions that are too broad. Access Context Manager adds conditions based on the user's device or network, creating context-aware access policies that meet strict governance rules.
For data protection, Customer-Managed Encryption Keys (CMEK) in Cloud KMS let you control your own encryption keys. This is key for data residency, as you can ensure your data is encrypted within a specific geographic region. Sensitive Data Protection scans and classifies data to prevent accidental exposure of sensitive information like credit card numbers.
To simplify compliance, Assured Workloads offers pre-packaged settings for frameworks like HIPAA or GDPR. It automatically configures data residency, enforces CMEK, and sets up network perimeters with VPC Service Controls. This unified posture combines identity, encryption, network, and logging controls into a verifiable architecture that directly meets regulatory mandates.
A financial enterprise is subject to strict regulatory compliance mandates governing data residency, cryptographic boundary isolation, and access governance. The security team needs to enforce the following controls across their Google Cloud environment:
Which combination of controls and Organization Policies should the enterprise implement?
StudyCerts
StudyCerts