Task 4.2: Configuring logging, monitoring, and detection.

• ATurn on DATA_READ Data Access audit logs for Cloud Storage in the project's audit configuration

  Correct

  Data Access audit logs are off by default for most services, Cloud Storage included; DATA_READ records reads of object data.

• BTurn on Admin Activity audit logs for Cloud Storage in the project's audit log configuration

  Incorrect

  Admin Activity logs are always written and cannot be configured; they record configuration changes such as the IAM change already visible, not reads.

• CTurn on VPC Flow Logs for the subnets of the VMs that might read from the bucket

  Incorrect

  Flow logs record network connections from VMs, not which principal read which object through the API.

• DTurn on Access Transparency for the organization so that object reads are logged

  Incorrect

  Access Transparency logs actions by Google personnel, not reads by the customer's own principals.

Cloud Audit Logs has four types. Admin Activity and System Event logs are always on. Data Access logs, which record reads of configuration and data and writes of user data, are off by default for all services except BigQuery and must be turned on per service, with ADMIN_READ, DATA_READ and DATA_WRITE types.

• AA sink in each project to a bucket in the security project, created by a project factory

  Incorrect

  Per-project sinks depend on every project being created by the factory, and project owners can delete or edit their own sinks.

• BAn aggregated sink at the organization that includes child resources, into a locked log bucket

  Correct

  An aggregated sink at the organization covers all current and future child projects and is out of project owners' reach, and a locked bucket's retention cannot be reduced.

• CA five-year retention on the _Required log bucket of each project, set by an organization policy

  Incorrect

  The _Required bucket's retention is fixed and cannot be configured, and it keeps logs in each project rather than in one place.

• DA log-based metric for each audit log type in the organization, kept for five years in Cloud Monitoring

  Incorrect

  Log-based metrics count entries; they do not keep the log entries themselves.

Aggregated sinks route logs from an organization or folder and their child resources to a central destination, and child resources created later are included automatically. Routing to a log bucket in a dedicated project and locking that bucket's retention meets keep-for-N-years requirements that project owners cannot undo.

• AA sink to a Cloud Storage bucket, with Splunk collecting the hourly batch files

  Incorrect

  Cloud Storage sinks write logs in hourly batches, which misses the seconds-level requirement.

• BAn Observability Analytics linked BigQuery dataset that Splunk queries every minute

  Incorrect

  Linked datasets let BigQuery query log buckets in place; polling them from Splunk is neither streaming nor what they are built for.

• CAn organization-level aggregated sink that routes the logs to a Pub/Sub topic

  Correct

  Routing to Pub/Sub delivers log entries as they arrive, and an aggregated sink covers every project in the organization.

• DLog-based metrics for the audit and firewall logs, with alerting policies that notify Splunk

  Incorrect

  Metrics and alerts carry counts and notifications, not the log entries the SOC needs.

• EA Dataflow pipeline built from the Pub/Sub to Splunk template

  Correct

  Google's reference architecture streams the topic's messages to Splunk's HTTP Event Collector with a Dataflow pipeline.

For streaming logs to a third-party SIEM, Google's reference architecture is an aggregated sink that routes the organization's logs to a Pub/Sub topic, and a Dataflow pipeline from the Pub/Sub to Splunk template that reads the subscription and sends the entries to Splunk HTTP Event Collector, with a dead-letter topic for failed messages.

• ALogs Viewer on the shared project for the payments team, with a saved query for the payments service

  Incorrect

  Logs Viewer on the project shows every log in its buckets; a saved query is a convenience, not a restriction.

• BA second sink that copies the payments service's entries into a bucket in the payments team's own project

  Incorrect

  A separate sink works but creates the second copy of the logs that the security team wants to avoid.

• CA log view filtered to the payments service, with View Accessor conditioned on that view

  Correct

  Log views expose a filtered subset of a bucket, and View Accessor with an IAM condition on the view name grants only that subset.

• DPrivate Logs Viewer for the payments team, scoped by a tag on the central log bucket

  Incorrect

  Private Logs Viewer on the project is broader, not narrower, than the requirement, and a tag on the bucket does not limit it to one service's entries.

A log view is a subset of the entries in a log bucket, defined by a filter. Granting roles/logging.viewAccessor with an IAM condition that names the view lets a team read only that view, so one central bucket can serve many teams without duplicating logs.

• AA continuous export of findings to BigQuery and a scheduled query that lists public buckets every day

  Incorrect

  A daily scheduled query only reports; it neither acts within minutes nor changes the bucket.

• BA mute rule for public bucket findings, so that only buckets approved by the team stay visible

  Incorrect

  Muting hides findings from views; it leaves the buckets public.

• CA log-based alert on the bucket's IAM change that emails the bucket owner a request to fix it

  Incorrect

  An email still needs a person to act, which the team wants to avoid.

• DA filtered notification config to Pub/Sub that triggers a Cloud Run function to remove the access

  Correct

  Notification configs publish matching findings to Pub/Sub in near real time, and a Cloud Run function subscribed to the topic can remove the public grant.

Security Command Center can publish new and updated findings to a Pub/Sub topic through a notification config with a filter, in near real time. Google's pattern for automated response is a Cloud Run function subscribed to that topic that fixes the resource, while mute rules and BigQuery exports serve triage and reporting.

• AVPC Flow Logs with all metadata fields and full sampling on the VMs' subnet

  Incorrect

  Flow logs sample connection metadata such as addresses, ports and bytes; they never include payloads.

• BFirewall rules logging with metadata on every rule that matches the three VMs

  Incorrect

  Rules logging records which rule matched a connection, not the packet contents.

• CPacket Mirroring for those VMs, with an internal load balancer collector

  Correct

  Packet Mirroring copies the full traffic, payloads and headers, of chosen sources to a collector instance group behind an internal load balancer.

• DData Access audit logs for Compute Engine in the project, exported to the appliance

  Incorrect

  Audit logs record API calls about resources, not network traffic to and from VMs.

Packet Mirroring clones the traffic of specified instances, subnets or tags and forwards it, payloads and headers included, to a collector destination, an instance group behind an internal passthrough load balancer. VPC Flow Logs and firewall rules logging capture only connection records.

• AWeb Security Scanner managed scans of the public applications

  Incorrect

  Web Security Scanner probes public web endpoints for vulnerabilities; it does not watch processes in containers or VMs.

• BContainer Threat Detection

  Correct

  Container Threat Detection watches Container-Optimized OS nodes and detects runtime attacks such as suspicious binaries and reverse shells.

• CVirtual Machine Threat Detection

  Correct

  VM Threat Detection scans the memory of running VMs from the hypervisor, without guest agents, for mining software and kernel-mode rootkits.

• DSecurity Health Analytics with the CIS benchmark detectors

  Incorrect

  Security Health Analytics finds misconfigurations, not processes running in containers or VMs.

• ESensitive Data Protection discovery for the organization

  Incorrect

  Discovery profiles data for sensitive content; it does not detect malware.

Security Command Center's threat detection services cover different layers. Container Threat Detection monitors container runtime on Container-Optimized OS nodes, VM Threat Detection inspects VM memory from the hypervisor without agents, and Event Threat Detection analyzes logs. Security Health Analytics and Web Security Scanner look for weaknesses rather than active attacks.

• AUpgrade the log bucket to use Observability Analytics and query it with SQL

  Correct

  Observability Analytics provides a SQL interface over upgraded log buckets for grouping and aggregation; the upgrade cannot be undone.

• BCreate a log-based counter metric for each permission and read the values in Cloud Monitoring

  Incorrect

  Metrics count entries matching a filter from their creation onward, not past entries, and would need one metric per permission.

• CWrite a Logs Explorer query with a summary field for each principal

  Incorrect

  The Logs Explorer does not support aggregate operations such as counts.

• DTurn on Data Access audit logs for IAM so that permission usage is aggregated in the bucket automatically

  Incorrect

  Turning on more logs adds entries; it does not aggregate them.

For troubleshooting, the Logs Explorer is the tool; for insights that group and aggregate log data, Cloud Logging offers Observability Analytics, a SQL interface over log buckets that have been upgraded to use it. A linked BigQuery dataset can also be added, and an upgraded bucket cannot be reverted.

• ARecreate the sink as an aggregated sink at the organization so that it inherits permission to every bucket

  Incorrect

  Aggregated sinks also write through a writer identity that needs permission on the destination; the scope of the sink is not the problem.

• BGrant the sink's writer identity Logs Bucket Writer in the central project

  Correct

  A sink writing to another project uses a service account, its writer identity, which needs logging.logEntries.route and Logs Bucket Writer on the destination.

• CTurn on Data Access audit logs in the central project so that incoming entries are accepted

  Incorrect

  Audit log settings in the destination do not authorize another project's sink to write.

• DGive the engineer Logs Viewer on the central project so that the routed entries become visible

  Incorrect

  Viewing rights do not make entries arrive; the sink itself cannot write to the bucket.

Every sink that writes outside its own project's log buckets has a writer identity, a service account. When the creator is not an owner of the destination, Cloud Logging cannot grant access automatically, so someone must grant the writer identity Logs Writer plus the destination role: Logs Bucket Writer for a log bucket, Storage Object Creator, BigQuery Data Editor or Pub/Sub Publisher for the other destinations.