Examkin

Question

Difficulty: EasySecurity Logging, Audit Logs, and Security Command Center

A security architect is configuring an enterprise-wide audit logging solution in Google Cloud Platform to stream Cloud Audit Logs from an entire organization to an external SIEM system via Pub/Sub. In what sequence should these steps be executed to establish the log export pipeline successfully?

  1. 1Create a target Pub/Sub topic in a centralized security administration project.
  2. 2Create an organization-level Cloud Logging sink specifying the Pub/Sub topic as the destination.
  3. 3Grant the Pub/Sub Publisher IAM role to the logging sink's unique writer service account on the Pub/Sub topic.
  4. 4Configure the external SIEM platform to consume audit messages from the Pub/Sub subscription.

Answer

The correct sequence is: first, create the target Pub/Sub topic in the central project; second, create the organization-level Cloud Logging sink pointing to the topic; third, grant the sink's unique writer service account the Pub/Sub Publisher role on the topic; and fourth, configure the SIEM to consume messages from the Pub/Sub subscription.
Establishing a Cloud Logging export pipeline requires creating the destination Pub/Sub topic first. Next, creating the organization-level log sink defines the filter rules and automatically creates a unique service account identity (writer identity). Third, this specific service account must be granted the Pub/Sub Publisher role on the topic to authorize writing. Finally, the downstream SIEM consumer connects to the subscription to pull the audit logs.

Step-by-Step Solution

1
Provision the destination Pub/Sub topic resource.
A target Pub/Sub topic is established to receive streamed log messages.
The destination endpoint must be created before a log sink can reference it as a valid destination.
2
Configure the aggregated Cloud Logging sink at the organization root.
An organization-level sink is created and Google Cloud automatically assigns a unique writer service account identity.
The log sink configuration establishes the audit log filter and generates the specific service account needed for publishing authorization.
3
Authorize the logging sink service account on the Pub/Sub topic.
The sink's writer service account gains Pub/Sub Publisher privileges on the destination topic.
Cloud Logging sinks do not have implicit write access to Pub/Sub topics across project boundaries without explicit IAM role grants.
4
Connect the downstream SIEM integration to the Pub/Sub subscription.
The SIEM begins ingesting real-time audit logs from Google Cloud.
Subscriber consumers can only ingest logs reliably once the underlying publisher pipeline and authorizations are fully configured.

Key Concept

Cloud Audit Logs Aggregated Export & Service Account Authorization Workflow
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic