Examkin

Question

Difficulty: MediumMonitoring, Logging, and Observability Integration

An enterprise architecture team needs to aggregate Cloud Audit Logs across all Google Cloud projects within an organization folder into a central BigQuery dataset for long-term security analysis, while also streaming high-severity security events to a central Pub/Sub topic for real-time alerting. The solution must minimize administrative overhead and avoid creating individual log sinks in every project. Which Cloud Logging architecture should the team implement?

  1. Create an aggregated Log Router sink at the organization folder level using an inclusion filter for Cloud Audit Logs, set BigQuery and Pub/Sub as targets, and grant the sink's writer identity appropriate access on the destinations.Answer
  2. B
    Apply a broad Log Router exclusion filter at the folder level to exclude audit logs from log buckets, assuming excluded log entries are automatically redirected to BigQuery and Pub/Sub.
  3. C
    Assign the primitive Owner role to a central service account across all projects to run custom scripts that periodically export log entries into BigQuery and Pub/Sub.
  4. D
    Rely strictly on project-level IAM permission inheritance without configuring Log Router sinks or VPC Service Controls, assuming IAM grants automatically consolidate logs into a central dataset.

Answer

Create an aggregated Log Router sink at the organization folder level using an inclusion filter for Cloud Audit Logs, set BigQuery and Pub/Sub as targets, and grant the sink's writer identity appropriate access on the destinations.
Creating an aggregated sink at the folder level automatically collects logs from all child projects under that folder. By specifying inclusion filters for Cloud Audit Logs and setting BigQuery and Pub/Sub as sink destinations, logs are securely routed in real time without per-project configuration.

Step-by-Step Solution

1
Identify the architectural requirement for multi-project log aggregation.
Realize that managing log sinks individually across projects creates overhead, whereas an aggregated sink at the folder level automatically captures logs from all current and future child projects.
Aggregated sinks streamline management and ensure compliance across resource hierarchies.
2
Determine the proper mechanism for routing logs to external systems.
Configure Log Router sinks with inclusion filters targeting BigQuery for analytical storage and Pub/Sub for real-time streaming.
Log Router sinks natively support multiple destinations while ensuring reliable delivery and authorization via writer identities.

Key Concept

Aggregated Log Router Sinks
Estimated Time:1m 30s
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic