Examkin

Question

Difficulty: HardSecurity Logging, Audit Logs, and Security Command Center

A multinational financial enterprise requires centralized security logging across hundreds of Google Cloud projects structured under an organization hierarchy. The security operations team must continuously stream Data Access audit logs from all projects to an external Security Information and Event Management (SIEM) platform in real time. Project-level administrators must not be able to modify, disable, or delete this logging pipeline within their respective projects. Which architecture best satisfies these security and governance requirements?

  1. Create an aggregated log sink at the organization root level filtering for Data Access audit logs, direct its destination to a Cloud Pub/Sub topic in a dedicated security project, and grant minimal IAM logging permissions.Answer
  2. B
    Grant the primitive Owner role across all projects to the security operations team and instruct them to configure project-level log sinks that target project-specific Cloud Pub/Sub topics.
  3. C
    Require Customer-Supplied Encryption Keys (CSEK) to be configured on all individual project log sinks before streaming log entries to the external SIEM.
  4. D
    Assign the Service Account Admin role to the automated deployment service account in each project to allow it to configure log sinks and manage export permissions to Pub/Sub.

Answer

Create an aggregated log sink at the organization root level filtering for Data Access audit logs, direct its destination to a Cloud Pub/Sub topic in a dedicated security project, and grant minimal IAM logging permissions.
Creating an aggregated log sink at the organization root level ensures centralized, immutably managed collection of Data Access audit logs across all projects. Directing the log sink to a Cloud Pub/Sub topic in a central security project enables real-time ingestion by external SIEM platforms while preventing project administrators from modifying the pipeline.

Step-by-Step Solution

1
Identify the organization-wide scope and immutability requirements.
Real-time log collection across all current and future projects requires an organization-level aggregate sink.
Sinks defined at the organization level apply hierarchically and cannot be disabled by project-level administrators.
2
Select the appropriate real-time streaming destination.
Cloud Pub/Sub provides low-latency streaming to third-party SIEM solutions.
Exporting audit logs to a Pub/Sub topic enables continuous real-time ingestion by external platforms.
3
Enforce least privilege and proper key/role management.
Use fine-grained IAM roles rather than primitive roles or overly permissive administrative grants.
Least privilege prevents administrative escalation and unauthorized tampering.

Key Concept

Organization Aggregated Log Sinks and Real-time Audit Log Exporting
Estimated Time:2m 0s
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic