Examkin

Question

Difficulty: HardMonitoring, Logging, and Observability Integration

An enterprise organization operates a multi-tenant payment platform across dozens of Google Cloud projects. To satisfy strict security compliance and operational requirements, high-severity application errors and audit logs across all projects must be aggregated into a centralized BigQuery dataset managed by the Security Operations team. However, high log generation rates from non-production diagnostic logging threaten to cause excessive Cloud Logging ingestion and storage costs. Which log routing and governance architecture should the Lead Cloud Architect implement?

  1. Create an aggregated Log Router sink at the organization folder level using an inclusion filter that selects audit logs and entries with severity equal to or greater than ERROR, routing to the central BigQuery dataset, while applying exclusion filters in non-production projects targeting only diagnostic logs with severity less than ERROR.Answer
  2. B
    Create an aggregated Log Router sink at the organization level to capture all project log entries, and apply a global log exclusion filter defined as severity greater than or equal to ERROR across non-production projects to minimize overall ingestion costs.
  3. C
    Configure individual project-level Log Router sinks across all projects pointing to the central BigQuery dataset, and grant the primitive Owner role to each sink service account on the destination log sink project to guarantee continuous write access.
  4. D
    Configure Log Router sinks across all workload projects to export log streams directly to a centralized Cloud Storage bucket, relying solely on IAM user access control lists to prevent unauthorized access and data exfiltration from the destination log bucket.

Answer

Implement an organization-level aggregated Log Router sink configured with explicit inclusion filters for audit logs and error severity (severity >= ERROR), while using exclusion filters in non-production projects strictly for low-severity diagnostic logs (severity < ERROR).
Creating an aggregated Log Router sink at the organization or folder level ensures centralized compliance and operational log aggregation into BigQuery across all project environments. Configuring inclusion filters for audit logs and high severity levels (severity >= ERROR) combined with non-production exclusion filters for lower severity levels (severity < ERROR) successfully reduces storage costs without discarding critical incident diagnostic data.

Step-by-Step Solution

1
Evaluate central governance requirements for multi-project log aggregation.
Using an organization-level aggregated sink enables central collection of compliance audit logs and critical application errors across all current and future projects.
Centralizing log router sinks at the folder or organization root avoids administrative drift and missing logs from newly created projects.
2
Determine the appropriate inclusion and exclusion filter configuration to manage costs without losing vital operational metrics.
Set inclusion filters for `severity >= ERROR` and audit logs, while filtering out verbose info/debug logs (`severity < ERROR`) at non-production sources.
Excluding debug/info logs reduces Cloud Logging ingestion fees while guaranteeing that high-severity operational events remain fully visible.
3
Verify security and least-privilege role requirements for log export service accounts.
Ensure sink service accounts are granted fine-grained destination roles (e.g., BigQuery Data Editor) rather than primitive roles, and protect sensitive storage locations using VPC Service Controls.
Adheres to security best practices for least privilege and data exfiltration prevention.

Key Concept

Log Router aggregated sinks and inclusion/exclusion filter strategy for enterprise observability and cost optimization.
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic