Examkin

Question

Difficulty: MediumMonitoring and Logging

A security compliance team needs to aggregate and retain all admin activity audit logs from every Google Cloud project residing within a specific organizational Folder. The logs must be streamed into a central BigQuery dataset located in a dedicated security project for long-term analysis. You need to configure this aggregated log export while adhering to the principle of least privilege. Which TWO actions should you perform? (Select 2 answers.)

  1. Create an aggregated Log Router sink at the Folder level with the destination configured to point to the central BigQuery dataset.Answer
  2. Grant the BigQuery Data Editor role to the sink's writer identity service account on the destination BigQuery dataset.Answer
  3. C
    Enable the Cloud Logging API at the Folder container level using gcloud commands before creating the sink.
  4. D
    Grant the primitive Owner role to the sink writer identity across the entire destination security project.

Answer

The correct actions are to create an aggregated Log Router sink at the Folder level pointing to the destination BigQuery dataset, and to grant the BigQuery Data Editor role to the sink's writer identity service account specifically on the target dataset.
Aggregated Cloud Logging sinks created at a folder level automatically collect log entries from all child projects within that folder. Furthermore, granting the predefined role of BigQuery Data Editor to the sink's writer identity on the target BigQuery dataset enforces least privilege while providing the necessary write permissions for ingestion.

Step-by-Step Solution

1
Identify the resource hierarchy level for log aggregation
To aggregate audit logs from multiple projects under a folder, an aggregated sink must be created at the Folder resource level.
Project-level sinks only collect logs within their own project boundaries, whereas folder-level sinks can include logs across child projects.
2
Configure destination permission using least privilege
Assign the BigQuery Data Editor role to the sink's writer identity on the destination dataset.
Log Router sinks use a service account (writer identity) to publish logs into cross-project destinations, which requires granular permissions on the target resource.

Key Concept

Aggregated Log Router Sinks and Cross-Project IAM Permissions
Rate this question

Topics

Monitoring and Logging

More questions from this topic