GCP Professional Cloud Security Engineer Practice Question

Your security team must detect any Cloud Storage buckets across hundreds of projects in your organization that do not have uniform bucket-level access (UBLA) enabled. The built-in Security Health Analytics (SHA) detectors do not cover this control. Security Command Center Premium is already activated at the organization level. What should you do to implement this control in a way that runs automatically and produces findings centrally for all projects?

Set the Organization Policy constraint constraints/storage.uniformBucketLevelAccess to enforced: TRUE; SHA will automatically generate findings when this policy is violated.
In the Security Command Center console, enable the built-in Legacy Storage IAM Binding detector and add a custom condition for UBLA.
Author a Security Health Analytics custom module in YAML that selects the asset type storage.googleapis.com/Bucket and contains a CEL rule flagging buckets where resource.uniformBucketLevelAccess.enabled == false, then deploy the module at the organization level with gcloud scc custom-modules create.
Create an Event Threat Detection custom alert policy that evaluates Cloud Storage bucket metadata with a CEL rule and enable it in each project.

Report Issue

Answer Description

The requirement is to extend Security Health Analytics with organization-specific logic. SHA supports custom modules that you define in YAML. A custom module lets you specify which Cloud Asset Inventory resource types to scan through a resourceSelector (in this case storage.googleapis.com/Bucket) and express compliance logic in a CEL rule (here, resource.uniformBucketLevelAccess.enabled == false). Deploying the module at the organization's custom-module source (for example with gcloud scc custom-modules create --organization [ORG_ID] --config-from-file=ubla.yaml) enables the detector to run during SHA's nightly scan and surface findings in Security Command Center. The other answers are incorrect because:

Enabling or modifying a legacy SHA detector through the console cannot add a new rule that SHA does not already support.
Event Threat Detection custom modules are unrelated to configuration-drift checks on buckets.
An Organization Policy enforces UBLA but does not create SHA findings unless a detector exists; merely setting the constraint will not satisfy the detection requirement.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.