Cloud Digital Leader Trust and security with Google Cloud Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud Audit Logs — reviewing all recent IAM changes.

  Why it's wrong here

  Cloud Audit Logs record historical IAM policy changes, including who made the change, when, and from where, but they do not evaluate the current security state of your resources. Reviewing audit logs manually to identify misconfigurations is tedious and error-prone, especially at scale, and logs only capture past events, not the present configuration. Audit Logs are useful for forensic analysis and compliance, but they lack the continuous, automated detection capabilities that Security Command Center provides for identifying existing high-risk IAM settings.

• ✓

  Security Command Center (SCC) with IAM Recommender and Security Health Analytics.

  Why this is correct

  Security Command Center (SCC) with Security Health Analytics and IAM Recommender is the correct choice because it provides continuous, automated scanning for high-risk IAM misconfigurations such as public Cloud Storage buckets, overly broad roles like Owner or Editor, and over-permissive service accounts. Security Health Analytics uses built-in detectors to evaluate the current state of your GCP resources, while IAM Recommender analyzes actual usage patterns to generate actionable recommendations for reducing permissions to least privilege. This combination proactively surfaces existing weaknesses and delivers concrete remediation steps, making it a comprehensive and proactive security posture management tool.

• ✗

  Cloud Billing reports — they flag expensive configurations that indicate security issues.

  Why it's wrong here

  Cloud Billing reports are designed to track cost, usage, and budget trends, and while a sudden spike in spend could indicate unusual resource usage, it does not directly flag security misconfigurations like overly permissive IAM roles or publicly accessible buckets. High costs can result from legitimate scaling, inefficient code, or misconfigured resource sizes, and have no inherent correlation with security risk. Billing data provides no visibility into IAM policy bindings or permissions, so it cannot identify over-privileged accounts or public access; relying on billing reports to surface security issues would miss most critical misconfigurations entirely.

• ✗

  Cloud Monitoring — it alerts when IAM policies are modified.

  Why it's wrong here

  Cloud Monitoring can be configured with log-based metrics to trigger alerts when IAM policies are modified, but this approach only reacts to changes as they happen; it does not assess the security implications of those changes or detect pre-existing misconfigurations that were put in place before the monitoring was set up. It also requires custom setup and does not provide any context about whether a change introduces risk, such as granting public access or excessive permissions. Cloud Monitoring is useful for operational telemetry and alerting, but it is not a dedicated security analyzer for IAM policies and lacks the integrated, continuous posture assessment that Security Command Center offers.

Go deeper

Related to this question