To automatically remediate dormant service account keys when a relevant finding is detected, which approach is recommended?

• A. Generate a YARA-L rule in SecOps that detects when a service account key is created and create a custom SOAR action to delete the key.
• B. Use the "Initial Access: Dormant Service Account Key Created" finding from SCC, ingest into SecOps, and create a custom SOAR action triggered on this finding to delete the key.
• C. Configure a Cloud Logging sink to Pub/Sub filtering CreateServiceAccountKey and a Cloud Run function to delete the key.
• D. Use the SCC finding, write to Pub/Sub, and a Cloud Run function to delete the key.

Answer: (B)

Automating remediation based on a precise security signal is most effective when the toolchain starts from that signal and triggers a controlled response inside your SecOps workflow. In this scenario, the strongest approach is to take the Security Command Center finding that explicitly flags a dormant service account key and feed it into SecOps, then execute a custom SOAR action that deletes the implicated key. This ties the remediation directly to a vetted, documented alert, so you delete the correct key, keep an auditable record of the action, and run the fix through your established incident-response processes.

This approach is better than building a host-style rule or a separate cloud pipeline. YARA-L rules are designed for host-based indicators and binaries, not cloud IAM events, which would require extra, brittle mappings and ongoing maintenance. Similarly, filtering Cloud Logging to Pub/Sub and invoking a Cloud Run function can work, but it bypasses SecOps governance and centralized incident handling, risking inconsistent responses and weaker auditability. By leveraging the SCC finding and routing it through SecOps with a tailored SOAR action, you get a clear, repeatable, and auditable remediation aligned with existing security workflows.