A company needs to retain audit logs for 3 years for compliance, but the security team is concerned about the cost of storing all logs in Cloud Logging. They also need to ensure that only authorized personnel can access the logs. Which strategy should they implement?

Export audit logs to a Cloud Storage bucket with a 3-year retention policy and restrict access using IAM

Increase Cloud Logging's retention period to 3 years

Export logs to BigQuery and set the table to expire after 3 years

Store logs in Pub/Sub and let them expire after 3 years

A company wants to aggregate audit logs from all projects in its organization and export them to a central BigQuery dataset for analysis. The security team needs to ensure that the export continues to work as new projects are added. Which configuration should they use?

Enable VPC flow logs in each project and export them to BigQuery

Use Cloud IDS to forward logs to BigQuery

Create an aggregated sink at the organization level that includes all projects and exports to the central BigQuery dataset

Create a log sink in each project to export logs to the central BigQuery dataset

A security team wants to receive notifications when Security Command Center detects a new vulnerability in a Compute Engine VM. They also want to be able to query the findings later for analysis. Which configuration should they implement?

Use Cloud IDS to detect vulnerabilities

Create a Cloud Monitoring alert on the VM's CPU utilization

Enable VPC flow logs and analyze them for vulnerabilities

Configure Security Command Center to send findings to Pub/Sub and create a Cloud Function that sends email notifications

Google CloudProfessional Cloud Security Engineer

Domain 4Objective 2

4.2 Configuring Logging, Monitoring, and Detection PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 2)

Part of the Managing operations domain, which accounts for 19% of the PROFESSIONAL-CLOUD-SECURITY-ENGINEER exam.

27questions here

6free pages

8concepts

19%of the exam

Questions 6–10

6expert · hard
A company needs to retain audit logs for 3 years for compliance, but the security team is concerned about the cost of storing all logs in Cloud Logging. They also need to ensure that only authorized personnel can access the logs. Which strategy should they implement?
Select an answer first
7foundation · easy
Which type of Cloud Audit Log records actions that read or modify user data, such as reading a file from Cloud Storage?
Select an answer first
8application · medium
A company wants to aggregate audit logs from all projects in its organization and export them to a central BigQuery dataset for analysis. The security team needs to ensure that the export continues to work as new projects are added. Which configuration should they use?
Select an answer first
9application · medium
A security team wants to receive notifications when Security Command Center detects a new vulnerability in a Compute Engine VM. They also want to be able to query the findings later for analysis. Which configuration should they implement?
Select an answer first
10foundation · easy
Which Google Cloud mechanism can be used to restrict access to log data based on the network context, such as limiting access to logs only from within a VPC?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.

4.2 Configuring Logging, Monitoring, and Detection PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 2)

Questions 6–10

A company needs to retain audit logs for 3 years for compliance, but the security team is concerned about the cost of storing all logs in Cloud Logging. They also need to ensure that only authorized personnel can access the logs. Which strategy should they implement?

Which type of Cloud Audit Log records actions that read or modify user data, such as reading a file from Cloud Storage?

A company wants to aggregate audit logs from all projects in its organization and export them to a central BigQuery dataset for analysis. The security team needs to ensure that the export continues to work as new projects are added. Which configuration should they use?

A security team wants to receive notifications when Security Command Center detects a new vulnerability in a Compute Engine VM. They also want to be able to query the findings later for analysis. Which configuration should they implement?

Which Google Cloud mechanism can be used to restrict access to log data based on the network context, such as limiting access to logs only from within a VPC?

Keep studying — Managing operations