A compliance team needs to verify that all Google Cloud Storage buckets in their organization have uniform bucket-level access enabled to prevent individual object ACLs from overriding IAM policies. They also want to identify any buckets that deviate from this security standard. Which combination of Google Cloud services should they use?
- ACloud Audit Logs and Cloud Logging.
- BCloud Monitoring and Cloud Alerting.
- CCloud Asset Inventory and Security Health Analytics.
- DData Loss Prevention (DLP) and Cloud Security Scanner.
Show answer & explanationAnswer & explanation
Correct answer: C. Cloud Asset Inventory and Security Health Analytics.
Cloud Asset Inventory provides a centralized inventory of all Google Cloud assets, including Cloud Storage buckets and their configurations. Security Health Analytics (part of Security Command Center) can then scan this inventory for compliance deviations, such as buckets without uniform bucket-level access enabled, and report them.
Why the other options are wrong
- A. Cloud Audit Logs record changes and access, but don't provide an inventory or proactively scan for configuration deviations against security standards.
- B. Cloud Monitoring collects metrics and logs, and Cloud Alerting sends notifications, but they don't inherently provide a compliance scanning capability for asset configurations.
- D. DLP inspects data content for sensitivity, and Cloud Security Scanner finds vulnerabilities in App Engine/Compute Engine, neither directly addresses bucket configuration compliance.
Cloud Asset Inventory & Security Health Analytics for Compliance
Cloud Asset Inventory provides a comprehensive inventory of all Google Cloud assets and their metadata, while Security Health Analytics (within Security Command Center) analyzes this inventory to detect misconfigurations and compliance violations against security standards.
- Cloud Asset Inventory catalogs all resources and their configurations.
- Security Health Analytics detects common misconfigurations (e.g., disabled UBLA).
- Used for security posture management and compliance auditing.
- Integrates to provide actionable insights for security teams.
Memory trick: To check your cloud's health, Inventory your assets, then Analyze for wealth!