SECURITY-OPERATIONS-ENGINEER practice question 8 of 15

Your company requires PCI DSS v4.0 compliance for its cardholder data environment (CDE) in Google Cloud. You use a Security Command Center (SCC)…

Domain Ensuring compliance

Your company requires PCI DSS v4.0 compliance for its cardholder data environment (CDE) in Google Cloud. You use a Security Command Center (SCC) security posture deployment based on the PCI DSS v4.0 template to monitor for configuration drift.1 This posture generates a finding indicating that a Compute Engine VM within the CDE scope has been configured with an external IP address. You need to take an immediate action to remediate the compliance drift identified by this specific SCC posture finding. What should you do?

Answer options

A: Enable and enforce the constraints/compute.vmExternalIpAccess organization policy constraint at the project level for the project where the VM resides.

B: Remove the CDE-specific tag from the VM to exclude the tag from this particular PCI DSS posture evaluation scan.

C: Reconfigure the network interface settings for the VM to explicitly remove the assigned external IP address. Correct answer

D: Navigate to the underlying Security Health Analytics (SHA) finding for public_ip_address on the VM. and mark this finding as fixed.

Correct Answer:

C. Reconfigure the network interface settings for the VM to explicitly remove the assigned external IP address.

Explanation

The Security Command Center (SCC) finding indicates a specific compliance drift: a Compute Engine VM within the Cardholder Data Environment (CDE) has an external IP address. The most direct and immediate remediation is to correct this specific misconfiguration. Reconfiguring the VM's network interface to remove the external IP address directly resolves the issue that triggered the finding. This action aligns with PCI DSS Requirement 1.3, which mandates prohibiting direct public access between the internet and any system component in the CDE. By removing the external IP, you eliminate the direct public access path, thus remediating the compliance drift at its source.

Why Incorrect

A. This is a preventative measure. While enforcing this organization policy is a best practice to prevent future occurrences, it does not remediate the existing VM that already has an external IP address.
B. Removing the tag only excludes the resource from the posture scan's scope. This action hides the compliance violation from the report but does not fix the underlying security risk, leaving the CDE exposed.
D. Marking a finding as fixed in the Security Command Center UI does not change the resource's actual configuration. The finding will reappear after the next scan because the root cause has not been addressed.

References

1. Google Cloud Documentation

Compute Engine

"Delete an external IP address": This document outlines the procedure for removing an external IP address from a VM's network interface. It states

"To deassign a static external IP address from a resource

you can either delete the network interface or change the network interface's configuration to not have an external IP address." This directly supports the action in option C.

Source: Google Cloud

Compute Engine Documentation

"Configure IP addresses for VM instances"

Section: "Delete an external IP address".

2. Google Cloud Documentation

Security Command Center

"PCI DSS v4.0 security posture": The PCI DSS v4.0 posture in SCC is designed to detect configurations that violate the standard's requirements. Requirement 1.3.1 states

"Implement a firewall at the perimeter of the CDE

which is configured to deny all traffic

and only allow traffic that is specifically authorized." A VM with a public IP in the CDE bypasses this intended perimeter

making its removal a necessary remediation step.

Source: Google Cloud

Security Command Center Documentation

"Supported security standards and benchmarks"

Section: "PCI DSS v4.0".

3. Google Cloud Documentation

Organization Policy Service

"Organization policy constraints": The documentation for the constraints/compute.vmExternalIpAccess constraint explains that it is used to "define the VM instances that are allowed to use external IP addresses." This confirms its role as a preventative control

not a tool for remediating an already-existing configuration.

Source: Google Cloud

Resource Manager Documentation

"Organization policy constraints"

Section: "Compute Engine constraints".

Keep practicing

Take the free SECURITY-OPERATIONS-ENGINEER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test