Examkin

Question

Difficulty: HardConfiguring Cloud Logging, Monitoring, and Operational Alerting

An enterprise architecture team is designing an operational observability solution for an organization containing over 100 Google Cloud projects. The team needs to set up centralized real-time alerting for system crash events recorded across all Compute Engine virtual machine instances. The solution must minimize administrative overhead, enforce the principle of least privilege, and route matching log entries to a central Cloud Pub/Sub topic located in a dedicated operational monitoring project. Which configuration approach should the architect recommend?

  1. Create an aggregated log sink at the organization level targeting the central Cloud Pub/Sub topic with an appropriate inclusion filter, and grant the sink's writer identity the Pub/Sub Publisher role on the destination topic.Answer
  2. B
    Create an aggregated log sink at the organization level targeting the central Cloud Pub/Sub topic with an appropriate inclusion filter, and grant the sink's writer identity the Editor primitive role on the monitoring project.
  3. C
    Create individual log sinks within each child project targeting the central Cloud Pub/Sub topic, and grant the service account responsible for creating the sinks the Service Account Admin role across the organization.
  4. D
    Configure an organization log sink to route all logs to the central Pub/Sub topic, and set a global exclusion filter on the organization resource to suppress all log entries except high-severity system errors.

Answer

The architect should create an aggregated log sink at the organization level with an inclusion filter targeting the central Cloud Pub/Sub topic, and grant the sink's writer identity the Pub/Sub Publisher role on the destination topic.
Creating an aggregated log sink at the organization resource level allows centralized log collection from all child projects, eliminating per-project configuration drift. Granting the sink's unique writer identity the predefined Pub/Sub Publisher role (`roles/pubsub.publisher`) directly on the target Pub/Sub topic satisfies security least-privilege standards.

Step-by-Step Solution

1
Evaluate scope and management overhead for log aggregation
Using an organization-level aggregated log sink allows central collection of logs from all current and future child projects without managing separate sinks in 100+ projects.
Organization-level sinks scale seamlessly across complex project hierarchies.
2
Determine destination routing and access control requirement
Aggregated sinks generate a unique service account (writer identity). The destination Pub/Sub topic must grant this specific identity permission to publish messages.
Cloud Logging export authentication relies on service account writer identities assigned to sinks.
3
Apply least-privilege IAM permissions
Assigning `roles/pubsub.publisher` on the target topic grants the exact permission required (`pubsub.topics.publish`) without granting excessive project-level or primitive permissions.
Least-privilege security policy dictates avoiding broad roles like Editor or Service Account Admin.

Key Concept

Organization Aggregated Log Sinks and Least-Privilege IAM
Rate this question

Topics

Configuring Cloud Logging, Monitoring, and Operational Alerting