Examkin

Question

Difficulty: HardMonitoring, Logging, and Observability Integration

A digital healthcare company runs patient telemetry and microservice workloads across Google Kubernetes Engine (GKE) clusters and on-premises infrastructure. The enterprise operations team needs to establish a centralized observability architecture. Requirements dictate that all administrative audit logs and application error events must be securely routed to a BigQuery dataset located in a dedicated compliance project for long-term retention. Additionally, operational metrics must stream into Cloud Monitoring, and non-essential debug logs must be filtered out without inadvertently dropping high-severity error events or audit records. Which architecture best meets these business and operational requirements following Google Cloud recommended practices?

  1. Deploy OpenTelemetry Collectors using standard Cloud Logging and Cloud Monitoring exporters. Configure an Organization-level Log Router aggregated sink with explicit inclusion filters targeting the compliance BigQuery dataset, while defining exclusion filters scoped strictly to low-severity debug logs.Answer
  2. B
    Configure an Organization-level Log Router aggregated sink pointing to BigQuery, and apply a broad exclusion filter matching `severity >= ERROR` to minimize ingestion overhead across the organization.
  3. C
    Grant the primitive `roles/owner` role to the OpenTelemetry Collector service account across all projects to grant full API permissions for writing metrics to Cloud Monitoring and exporting audit logs directly to BigQuery.
  4. D
    Rely strictly on standard IAM roles like `roles/logging.configWriter` and `roles/bigquery.dataEditor` to restrict log routing destinations to the compliance project, avoiding VPC Service Controls since IAM permissions alone prevent unauthorized log data exfiltration.

Answer

Deploy OpenTelemetry Collectors using standard Cloud Logging and Cloud Monitoring exporters. Configure an Organization-level Log Router aggregated sink with explicit inclusion filters targeting the compliance BigQuery dataset, while defining exclusion filters scoped strictly to low-severity debug logs.
The solution using OpenTelemetry Collectors with standard exporters alongside an Organization-level Log Router aggregated sink ensures centralized compliance export to BigQuery while precisely filtering only low-severity debug logs to control costs without losing vital operational or audit data.

Step-by-Step Solution

1
Analyze observability and telemetry ingestion requirements
Identify that metrics require Cloud Monitoring integration while audit logs and errors require central BigQuery long-term retention.
Different operational telemetry types require distinct destination pipelines for monitoring vs compliance storage.
2
Evaluate central log routing and cost management strategies
Configure Organization-level Log Router aggregated sinks to centralize logs into BigQuery while restricting exclusion filters to debug logs.
Overbroad exclusion filters risk dropping high-severity error and audit logs needed for compliance and incident response.
3
Apply security and identity best practices
Avoid primitive IAM roles and rely on security perimeters combined with fine-grained IAM roles for audit data protection.
Primitive roles grant excessive privileges, and IAM alone cannot guarantee exfiltration protection without VPC Service Controls.

Key Concept

Centralized Log Routing, Observability Integration, and Cost Optimization Guardrails
Estimated Time:2m 0s
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic