Examkin

Question

Difficulty: MediumMonitoring and Logging

An organization is setting up telemetry collection and audit log retention for a fleet of Compute Engine virtual machines deployed across multiple GCP projects. The operations team needs to collect OS-level memory utilization metrics from the instances and automatically export application audit logs to a centralized BigQuery dataset located in a dedicated security governance project. Which of the following configuration steps are required to achieve this operational objective according to Google-recommended practices? (Select TWO options.)

  1. Install and configure the Google Cloud Ops Agent on the Compute Engine virtual machine instances.Answer
  2. Create a Log Router sink targeting the central BigQuery dataset with an appropriate log inclusion filter.Answer
  3. C
    Install the legacy Stackdriver Monitoring agent alongside the standalone Stackdriver Logging agent on each VM instance.
  4. D
    Grant the primitive Owner role to the sink service account on the central BigQuery project.

Answer

Installing the Google Cloud Ops Agent on the instances and creating a Log Router sink directed to the BigQuery dataset are the required Google-recommended steps.
To collect extended telemetry like memory metrics from Compute Engine VMs, the Google Cloud Ops Agent must be installed inside the guest OS. To export audit logs across projects to BigQuery, a Log Router sink with an inclusion filter and BigQuery sink destination must be created.

Step-by-Step Solution

1
Identify the required agent for collecting extended OS system metrics such as memory utilization.
Determine that the unified Google Cloud Ops Agent is the current recommended agent for Compute Engine telemetry.
Compute Engine hypervisor metrics do not include OS-level memory utilization without an in-guest agent.
2
Identify the proper Cloud Logging feature for routing audit logs to a central BigQuery dataset.
Determine that a Log Router sink configured with a BigQuery destination and log filter is required.
Log Router sinks manage the aggregation and export of log records to storage or analytics destinations.
3
Evaluate access control requirements for log routing.
Ensure least-privilege predefined roles (like BigQuery Data Editor) are assigned to the sink writer identity rather than primitive roles.
Primitive roles grant excessive privileges across the target project.

Key Concept

Google Cloud Monitoring agent architecture and Log Router sink export configuration
Rate this question

Topics

Monitoring and Logging

More questions from this topic