Manage operations
Manage operations
This domain tests detection, logging, investigation, and response. Questions often ask which log source or tool proves an event and how to preserve evidence.
Core rules
- Cloud Audit Logs: Admin Activity and System Event logs are always on. Data Access logs are off by default for most services and must be enabled; they can be high-volume and costly. Audit logs are immutable but can be excluded from sinks.
- Log Router: aggregated sinks at organization/folder/project export to Cloud Logging buckets, BigQuery, Pub/Sub, or Cloud Storage. Locked buckets support retention; export before an incident if you need long-term evidence.
- Security Command Center aggregates findings: misconfigurations, vulnerabilities, and threats from Event Threat Detection and Container Threat Detection. It is not a replacement for raw logs; findings can export to Pub/Sub.
- Network telemetry: VPC Flow Logs record accepted/denied flows; firewall rules logging records rule matches; Packet Mirroring copies traffic for deep forensics.
- Response: isolate a compromised VM with firewall/tag changes, snapshot disks before deletion, disable or rotate keys, review IAM, and preserve logs.
- Monitoring: log-based metrics and alerting policies in Cloud Monitoring turn audit events into alerts; uptime checks are not security detections.
Worked example
A service account key is used from an unusual country. Start with Cloud Audit Logs to identify the principal, API calls, and source; check VPC Flow Logs for egress; review SCC threat findings. Disable the key, rotate credentials, and export relevant logs to a locked bucket. Do not delete the VM before snapshotting its disk-that destroys evidence. Time-bound the investigation and document each action for the incident record.
Traps
Assuming Data Access logs are enabled by default; deleting an instance before forensic snapshot; relying only on SCC findings without raw logs; forgetting default log retention; and failing to enable firewall rule logging before an incident.