Exam Professional Cloud Security Engineer topic 1 question 77 discussion

Actual exam question from Google's Professional Cloud Security Engineer

Question #: 77
Topic #: 1

[All Professional Cloud Security Engineer Questions]

Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was done using the App Engine Default Service Account.
What should you do?

A. 1. Use Cloud Logging and filter on BigQuery Insert Jobs. 2. Click on the email address in line with the App Engine Default Service Account in the authentication field. 3. Click Hide Matching Entries. 4. Make sure the resulting list is empty.
B. 1. Use Cloud Logging and filter on BigQuery Insert Jobs. 2. Click on the email address in line with the App Engine Default Service Account in the authentication field. 3. Click Show Matching Entries. 4. Make sure the resulting list is empty.
C. 1. In BigQuery, select the related dataset. 2. Make sure that the App Engine Default Service Account is the only account that can write to the dataset.
D. 1. Go to the Identity and Access Management (IAM) section of the project. 2. Validate that the App Engine Default Service Account is the only account that has a role that can write to BigQuery.

Show Suggested Answer

Suggested Answer: A 🗳️

by tangac at Sept. 6, 2022, 6:56 p.m.

Comments

Submit Cancel

AwesomeGCP

Highly Voted 2 years, 4 months ago

Selected Answer: A

A. 1. Use StackDriver Logging and filter on BigQuery Insert Jobs. 2. Click on the email address in line with the App Engine Default Service Account in the authentication field. 3. Click Hide Matching Entries. 4. Make sure the resulting list is empty.

upvoted 13 times

Appsec977

1 year, 8 months ago

Stackdriver is now Cloud Operations.

upvoted 2 times

...

blacortik

Highly Voted 1 year, 5 months ago

Selected Answer: B

A: This option seems to be about using Cloud Logging and hiding matching entries. However, hiding matching entries wouldn't help in verifying the specific service account used for BigQuery Insert Jobs. C: While restricting permissions in BigQuery is important for security, it doesn't directly help you validate the specific service account that wrote the data. D: While IAM roles and permissions are important to manage access, it doesn't provide a clear process for verifying the service account used for a specific action. In summary, option B provides the appropriate steps to validate that data written to BigQuery was done using the App Engine Default Service Account by examining the Cloud Logging entries.

upvoted 5 times

anciaosinclinado

4 months, 3 weeks ago

Yes, but *hiding* log entries associated with App Engine Default Service Account will help *validate* that all data written to BigQuery was written by such service account. If we show only entries associated to this service account we wouldn't achieve the question objective. So A is correct.

upvoted 1 times

...