Question

You are a SecOps engineer triaging a batch of SCC findings surfaced in Google SecOps. One finding is categorized as CRITICAL severity: a Compute Engine instance with a publicly exposed SSH port. However, the finding's attack path and asset context show the instance is in an isolated sandbox project with no service account permissions, no sensitive data, and is scheduled for deletion within 24 hours. Meanwhile, a MEDIUM severity finding flags overly permissive IAM on a service account that has active Editor access to the production data warehouse project. With limited time, how should you prioritize triage of these two findings?

Accepted Answer

Investigate the MEDIUM IAM finding first, because asset criticality and exploitability toward production data outweigh the static CRITICAL severity label on the isolated sandbox instance.

Answer

Always investigate the CRITICAL SSH finding first, since SCC severity is the authoritative ranking and must not be overridden by analyst judgment.

Answer

Close both findings as false positives, since the sandbox is being deleted and IAM findings are typically informational.

Answer

Escalate both findings to the platform team without triage, because SCC findings are their responsibility to remediate.