Examkin

Question

Difficulty: MediumViewing and Analyzing Cloud Audit Logs

An organization requires all Cloud Audit Logs from a production project to be exported to a central BigQuery dataset in a dedicated security project for long-term retention and analysis. Which TWO of the following configurations are required to complete this log routing setup successfully? Select two.

  1. Create a log sink in the production project specifying the BigQuery dataset as the destination.Answer
  2. Grant the log sink's writer service account the BigQuery Data Editor role on the destination dataset.Answer
  3. C
    Assign the primitive Owner role to the log sink writer identity at the organization level.
  4. D
    Enable Uniform Bucket-Level Access on the destination BigQuery dataset to permit sink writes.

Answer

Exporting Cloud Audit Logs to an external BigQuery dataset requires creating a log sink in the source project configured with the BigQuery destination URI, and granting the sink's generated writer service account the BigQuery Data Editor role on the target dataset.
To route Cloud Audit Logs across projects to BigQuery, a log sink must be configured in the source project pointing to the target BigQuery dataset. Additionally, Cloud Logging provisions a dedicated writer identity (service account) for the sink, which must be granted the BigQuery Data Editor role on the destination BigQuery dataset to authorize table creation and log entry writes.

Step-by-Step Solution

1
Define the export route
A log sink is created in the production project pointing to the target BigQuery dataset URI.
Log sinks filter and route incoming audit logs to supported external destinations.
2
Retrieve writer identity
Cloud Logging automatically generates a unique service account identity (writerIdentity) for the sink.
Log sinks authorize writes using service account impersonation rather than user credentials.
3
Configure destination permissions
The BigQuery Data Editor role (roles/bigquery.dataEditor) is granted to the sink's writer service account on the target dataset.
The service account requires explicit write access to stream audit log entries into BigQuery tables.

Key Concept

Routing Cloud Audit Logs to BigQuery using Log Sinks and Service Account Identities
Estimated Time:1m 30s
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic