Examkin

Question

Difficulty: HardSecurity Logging, Audit Logs, and Security Command Center

A regulatory compliance audit requires a healthcare organization to capture all Google Cloud Data Access audit logs across all projects and securely retain them for seven years. The solution must ensure that log data is encrypted using customer-managed encryption keys (CMEK) and protected against premature deletion or tampering by any privileged user, including organization admins. In which chronological order should a Cloud Security Architect perform the required implementation steps?

  1. 1Enable Data Access audit logs for the relevant GCP services at the Organization level in IAM & Admin configuration.
  2. 2Create a Customer-Managed Encryption Key (CMEK) in Cloud KMS and grant the Cloud Logging Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role.
  3. 3Create a custom Cloud Logging bucket at the organization level configured with a 2,555-day retention period and the KMS key reference.
  4. 4Create an Organization-level aggregated log sink that uses a filter for Data Access audit logs and targets the CMEK-encrypted log bucket.
  5. 5Lock the retention policy on the custom log bucket using the Google Cloud CLI or API.

Answer

The correct sequence starts by enabling Data Access audit logging at the organization level, provisioning a Cloud KMS key and granting the Cloud Logging service agent necessary crypto permissions, building the CMEK-encrypted log bucket with a 7-year retention window, creating the organization-aggregated log sink targeting this bucket, and finally locking the log bucket retention policy.
The sequence follows the logical dependency chain for secure compliance logging in GCP: first generating the required audit log stream (Data Access logs), then preparing encryption keys and granting key-access permissions to the logging service agent, followed by creating the target CMEK-enabled log bucket with the required retention period. Next, the organization-level aggregated sink is configured to route logs to the target bucket. Finally, after verification, the retention policy is locked to enforce immutable WORM compliance.

Step-by-Step Solution

1
Configure organization-wide Audit Config policy to capture Data Access logs for the designated services.
GCP services begin generating Data Access audit trail logs for data read and write calls across all current and future projects.
Data Access logs are disabled by default due to high volume, so they must be explicitly turned on at the hierarchy root.
2
Provision a KMS Key Ring and Key, then assign roles/cloudkms.cryptoKeyEncrypterDecrypter to the logging service service account.
Cloud Logging is authorized to use the customer-managed key for encrypting and decrypting log data.
Creating a CMEK-encrypted log bucket will fail if the Cloud Logging service account lacks active encrypter/decrypter permissions on the specified key.
3
Provision a custom Cloud Logging bucket with 2555 days of retention bound to the created Cloud KMS key.
A secure, CMEK-backed log bucket destination is established within Cloud Logging.
The log sink destination must exist and be properly configured before an aggregated sink can start routing log entries to it.
4
Establish an organization-level aggregated log sink pointing to the custom log bucket with an explicit filter targeting Data Access logs.
Data Access audit logs generated across all child projects and folders automatically aggregate into the custom CMEK log bucket.
Aggregated sinks catch logs across the entire organizational hierarchy, avoiding project-by-project manual sink management.
5
Execute the bucket retention lock command against the custom log bucket.
The retention policy becomes permanent and immutable, enforcing strict compliance against deletion.
Locking the policy enforces WORM (Write Once Read Many) guarantees required by legal and regulatory frameworks.

Key Concept

Organization-level CMEK-encrypted log retention and immutable bucket lock implementation for compliance audit logging.
Estimated Time:2m 30s
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic