GCP Professional Cloud Security Engineer Practice Question

Your financial services company operates dozens of GCP projects. You have enabled Security Command Center Premium at the organization level and turned on Cloud IDS, Security Health Analytics, and Container Threat Detection. The security operations team must receive an incident ticket as soon as a new HIGH or CRITICAL finding appears, without building custom polling logic or managing additional infrastructure. Which solution satisfies these requirements with the least operational overhead?

Set up an organization-level aggregated log sink to BigQuery, then schedule a Cloud Scheduler job every hour to query for new HIGH or CRITICAL findings and create tickets through Cloud Run.
Enable Security Command Center findings notifications to publish to a dedicated Pub/Sub topic, and deploy a Cloud Function triggered by that topic to call the incident-management system's API.
Use the built-in Jira integration in Security Command Center and map HIGH and CRITICAL severities to automatically create incident tickets.
Create a log-based metric on Security Command Center logs, configure a Cloud Monitoring alert that publishes to Pub/Sub, and trigger a Cloud Function from that topic to open a ticket.

Report Issue

Answer Description

Security Command Center (SCC) can natively publish every new or updated finding to Cloud Pub/Sub through the SCC notifications service. By enabling notifications and pointing them to a dedicated Pub/Sub topic, findings-filtered to only HIGH or CRITICAL severities-are streamed in real time. Cloud Functions offers a fully managed, event-driven execution environment that can subscribe to the same topic and invoke the incident-management system's API to open a ticket, eliminating the need to maintain servers or periodic polling logic. Creating log-based metrics with alerting, building scheduled queries in BigQuery, or relying on a non-existent built-in Jira integration either introduce additional operational overhead, delay detection, or are simply unsupported. Therefore, using SCC notifications to Pub/Sub combined with a Pub/Sub-triggered Cloud Function best meets the stated requirements with minimal operational effort.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.