To receive an alert when a privileged Google Group is modified to grant public access, which configuration is most appropriate?

• A. Enable Google Drive log events and a reporting rule for public link visibility.
• B. Enable VPC Flow Logs and log-based alert for Google Groups API endpoints traffic.
• C. Enable IAM Admin Activity audit logs, export to SecOps, write a YARA-L rule for changes.
• D. Enable data sharing for Google Workspace Admin Audit logs; ensure ETD is enabled.

Answer: (D)

Monitoring privileged group changes requires centralized admin activity data and automated detection for visibility shifts. Google Workspace Admin Audit logs capture actions that modify groups, including changes to who has access and whether a group is exposed publicly. By turning on data sharing for these logs, SecOps gains a centralized feed they can analyze and alert on. Enabling Event Threat Detection (ETD) equips you with built-in and customizable detection rules that specifically look for risky admin activities, such as altering a group's visibility to public or granting external access. When a privileged Google Group is modified in a way that makes it publicly accessible, ETD can flag the event and trigger an alert, enabling quick investigation and response. Other options miss the target data—Drive logs focus on file-level sharing, VPC Flow Logs track network traffic, and Cloud IAM Admin Activity logs don’t cover Google Groups visibility changes—so they’re not as effective for this scenario.