Examkin

Question

Difficulty: MediumMonitoring, Logging, and Observability Integration

A SaaS company operates an online payment processing API on Google Kubernetes Engine (GKE). The platform team needs to implement a unified observability architecture to satisfy two core mandates: securely export operational logs to BigQuery for multi-year compliance analysis without inadvertently filtering out critical system events, and establish proactive alerting that detects sustained Service Level Objective (SLO) degradation rather than reacting to short-term metric noise. Which TWO architecture decisions should the cloud architect recommend?

  1. Create an aggregated Log Router sink at the Google Cloud Organization level with BigQuery as the destination, including explicit inclusion filters for audit and error logs while avoiding aggregate exclusion filters on high-severity events.Answer
  2. Define Service Level Indicators (SLIs) for API request latency and success rates, and configure Cloud Monitoring alerting policies based on multi-window error budget burn rates.Answer
  3. C
    Configure an aggregate exclusion filter on the Log Router sink to drop all logs matching ERROR severity to minimize BigQuery storage and ingestion expenses.
  4. D
    Set up static Cloud Monitoring threshold alerts on pod CPU utilization exceeding 80% to page on-call engineers for immediate incident mitigation.
  5. E
    Grant the primitive Owner IAM role to the Log Router sink's service account to guarantee write access across all target BigQuery datasets.

Answer

The architect should recommend creating an aggregated Log Router sink targeting BigQuery without overbroad exclusion filters, and implementing Cloud Monitoring alert policies based on multi-window error budget burn rates.
Aggregated Log Router sinks at the organization level ensure compliance logs from all projects stream to BigQuery without risk of dropping critical error events. Furthermore, multi-window error budget burn rate alerts effectively identify true service reliability degradation before SLOs are breached.

Step-by-Step Solution

1
Evaluate compliance log retention requirements.
Aggregated Log Router sinks configured at the organization level allow central routing of audit and system logs to BigQuery, while ensuring high-severity logs are preserved by avoiding aggressive exclusion filters.
Log exclusion filters intended to reduce costs can inadvertently drop essential error events if configured too broadly.
2
Evaluate incident alerting requirements.
Configuring alerts based on multi-window error budget burn rates measures the rate at which the service consumes its error budget over time.
Burn rate alerts align directly with SLO impact and eliminate noise caused by brief, self-healing metric spikes.

Key Concept

Centralized Observability Integration and Error Budget Alerting
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic