You work for an organization that uses Security Command Center (SCC) with Event Threat Detection (ETD) enabled. You need to enable ETD detections for data exfiltration attempts from designated sensitive Cloud Storage buckets and BigQuery datasets. You want to minimize Cloud Logging costs. What should you do?

Event Threat Detection (ETD) relies on Cloud Audit Logs to identify threats like data exfiltration. Specifically, to detect attempts to read and exfiltrate data from Cloud Storage or BigQuery, ETD requires Data Access audit logs of the "data read" type. The question emphasizes two key constraints: targeting only designated sensitive resources and minimizing logging costs. Enabling "data read" logs specifically and only for the sensitive buckets and datasets directly fulfills the detection requirement while being the most cost-effective approach, as Data Access logs can generate significant volume and cost if enabled broadly.

B: Including "data write" logs is unnecessary for detecting data exfiltration (a read activity) and would increase logging volume and costs, violating the minimization constraint. C: Enabling logs for all resources is overly broad, directly contradicting the requirements to target only sensitive data and minimize costs. D: VPC Flow Logs track network traffic but lack the application-layer context (e.g., user identity, specific data object) that ETD uses for its BigQuery and Cloud Storage exfiltration detectors.

1. Google Cloud Documentation

"Event Threat Detection detectors": Under the "Exfiltration" module

detectors like Exfiltration: BigQuery Read Rows Limit Exceeded and Exfiltration: Cloud Storage Egress Traffic explicitly list "Data Access audit logs" as the required log source. This confirms the necessity of these logs for the specified detection goal.

Source: Google Cloud

Security Command Center Documentation

"Event Threat Detection detectors"

section on "Exfiltration".

2. Google Cloud Documentation

"Cloud Audit Logs Overview": This document explains that Data Access audit logs "contain API calls that read the configuration or metadata of resources

as well as user-driven API calls that create

modify

or read user-provided resource data." It also states

"Because Data Access audit logs can be quite large

they are disabled by default". This supports the need to enable them selectively to minimize costs.

Source: Google Cloud

Cloud Logging Documentation

"Overview of Cloud Audit Logs"

section on "Data Access audit logs".

3. Google Cloud Documentation

"Configuring Data Access audit logs": This guide provides instructions on how to enable Data Access audit logs for specific services and resources

which is the action required by the correct answer. It demonstrates that logging can be configured granularly to meet security needs without enabling it organization-wide.

Source: Google Cloud

Cloud Logging Documentation

"Configuring Data Access audit logs"

section "Configure Data Access audit logs with the Google Cloud console".