A company has been running their application on Compute Engine.
A bug in the application allowed a malicious user to repeatedly execute a script that results in the Compute Engine instance crashing.
Although the bug has been fixed, you want to get notified in case this hack re-occurs.
What should you do?
Click on the arrows to vote for the correct answer
A. B. C. D.C.
https://cloud.google.com/logging/docs/logs-based-metrics/The correct answer in this case is C. Log every execution of the script to Stackdriver Logging. Create a User-defined metric in Stackdriver Logging on the logs, and create a Stackdriver Dashboard displaying the metric.
The reason why this option is the best choice is that it allows you to monitor the application at a more granular level. By logging every execution of the script, you can create a custom metric that tracks the number of script executions over time. This way, you can create a Stackdriver dashboard that displays this metric and allows you to monitor any spikes in activity.
Option A, creating an Alerting Policy in Stackdriver using a Process Health condition, checking that the number of executions of the script remains below the desired threshold, is not the best option. This is because this option assumes that the attacker will continue to execute the script and that the number of executions will remain below a certain threshold. This approach is reactive rather than proactive, and it may not be effective if the attacker changes their tactics.
Option B, creating an Alerting Policy in Stackdriver using the CPU usage metric, is not the best option either. This is because high CPU usage could be caused by many things other than the execution of the script. This approach is too broad and may result in false positives, leading to alert fatigue.
Option D, logging every execution of the script to Stackdriver Logging, and configuring BigQuery as a log sink, is not the best option either. This option requires more setup and configuration than option C, and it is not necessary in this case. Additionally, it is more appropriate when analyzing logs in large scale environments or for complex analysis of data over time, and not for monitoring the activity of a specific application.