Investigate Suspicious Service Account Login Attempt | PCSE

Incident Response & Threat Detection

Answer Correct answer: D — Check Event Threat Detection in Security Command Center for alerts and cross-reference with Cloud Audit Logs to validate suspicious service account activity.

During a routine security review, your team discovered a suspicious login attempt to impersonate a highly privileged but regularly used service account by an unknown IP address. You need to effectively investigate in order to respond to this potential security incident. What should you do?

Enable Cloud Audit Logs for the resources that the service account interacts with. Review the logs for further evidence of unauthorized activity.
Review Cloud Audit Logs for activity related to the service account. Focus on the time period of the suspicious login attempt.
Run a vulnerability scan to identify potentially exploitable weaknesses in systems that use the service account.
Check Event Threat Detection in Security Command Center for any related alerts. Cross-reference your findings with Cloud Audit Logs. Correct Answer

event threat detection pcse security command center incident response service account login investigation cloud audit logs vs scc

Community Votes

62%

38%

62% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests knowledge of centralized threat detection versus manual log review, with the common trap being choosing basic audit log inspection over automated security alerting platforms.

This PCSE question tests effective incident response using Google Cloud’s native security tools. Community consensus confirms that leveraging Security Command Center’s Event Threat Detection alongside Cloud Audit Logs is the optimal approach for investigating suspicious service account logins.

Many candidates select B because Cloud Audit Logs are always available, but they overlook that Event Threat Detection provides contextualized, prioritized alerts specifically designed for rapid incident investigation and correlation.

Community Discussion (5 comments)

BPzen 👍 1 Selected: D

Event Threat Detection (ETD) in Security Command Center (SCC): ETD automatically detects suspicious activity, such as anomalous service account usage or potential credential compromise, by analyzing logs in near real-time. Checking ETD alerts can quickly surface relevant insights about the suspicious activity. Cloud Audit Logs: Cross-referencing findings in ETD with Cloud Audit Logs helps confirm the scope of the incident by providing a complete history of actions performed by the service account, including the time of the suspicious login attempt.

dv1 👍 3 Selected: B

Question does not say that SCC is enabled, does it?

Mr_MIXER007 👍 1 Selected: D

1e22522 👍 2 Selected: D

D. Check Event Threat Detection in Security Command Center for any related alerts. Cross-reference your findings with Cloud Audit Logs. Explanation: Security Command Center (SCC) is Google Cloud's security and risk management platform. Event Threat Detection within SCC is specifically designed to detect suspicious activity, such as unauthorized logins, and generates alerts based on predefined threat patterns. This tool would help you quickly identify if the suspicious login attempt is part of a known threat pattern. After checking for alerts in Event Threat Detection, cross-referencing with Cloud Audit Logs will give you detailed insights into the actions performed by the service account, allowing you to investigate the extent of any potential breach.

yokoyan 👍 1 Selected: D

I think it's D.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Event Threat Detection (ETD) in Security Command Center is purpose-built to identify anomalous behavior, such as unauthorized service account access from unknown IPs. By checking ETD alerts first, engineers can quickly triage threats before diving into raw logs. Cross-referencing these alerts with Cloud Audit Logs validates findings and provides the granular details needed for forensic analysis.

Why the Other Options Are Wrong

Option A is reactive and inefficient since enabling logs after an incident delays investigation. Option B relies solely on manual log review, which lacks the correlation and prioritization features of a dedicated threat detection platform. Option C addresses infrastructure vulnerabilities rather than authentication anomalies, making it irrelevant to a credential compromise scenario.

Community Comment Notes

Candidates frequently debate whether Security Command Center must be explicitly enabled in the prompt. However, PCSE exams assume foundational security tools are active when evaluating best practices. Comments highlight that ETD’s near-real-time analysis significantly reduces mean time to detect (MTTD), aligning with professional security engineering standards.

Official Reference

Exam Strategy

Always prioritize managed security services like Security Command Center over manual log inspection during incident response questions. Look for keywords indicating proactive threat detection, correlation, and cross-service validation.

Frequently Asked Questions

Why is reviewing Cloud Audit Logs alone insufficient for this scenario?

Manual log review lacks automated correlation and prioritization. Event Threat Detection surfaces relevant alerts faster, enabling efficient triage before deep-diving into raw logs.

Does the question imply Security Command Center is already enabled?

Yes, PCSE assumes core security posture tools are active. The exam tests optimal incident response workflows, not infrastructure provisioning steps.

Related Analysis

← Back to PCSE Study Guide