Examkin

Question

Difficulty: MediumSecurity Logging, Audit Logs, and Security Command Center

An organization requires all Data Access audit logs across all projects in their Google Cloud organization to be centralized into a BigQuery dataset housed within a dedicated security governance project for compliance analytics. In what sequential order should a Cloud Security Architect execute these implementation steps to establish this aggregated log export?

  1. 1Provision a dedicated security governance project and create the destination BigQuery dataset within it.
  2. 2Create an organization-level aggregated log sink configured with a filter for Data Access audit logs and set the destination to the BigQuery dataset.
  3. 3Retrieve the unique writer service account identity generated by the organization log sink.
  4. 4Grant the BigQuery Data Editor role to the log sink writer service account on the destination BigQuery dataset.

Answer

The correct sequence begins with provisioning the target BigQuery dataset in the security project, followed by creating the organization aggregated log sink, retrieving the generated writer service account identity, and finally granting that service account the required IAM role on the destination dataset.
Centralized log aggregation in GCP requires preparing the target storage resource first. Next, creating the organization aggregated log sink establishes the log filter and generates a unique service account writer identity. After retrieving this service account identity, granting it write permissions (such as BigQuery Data Editor) on the target dataset enables authorized log delivery across the organization.

Step-by-Step Solution

1
Create the target BigQuery dataset inside a dedicated security project.
A destination dataset is available to store centralized logs.
Cloud Logging sinks require a pre-existing destination path upon sink creation.
2
Define an organization-level aggregated sink pointing to the dataset with a Data Access log filter.
The aggregated sink route is established, generating a unique writer service account.
Cloud Logging uses distinct service accounts per sink to maintain least-privilege log delivery.
3
Extract the writer service account principal ID from the log sink details.
The specific service account identity is available for role assignment.
The writer service account is dynamically created by GCP during sink definition.
4
Grant the BigQuery Data Editor role to the sink service account on the target dataset.
The sink receives authorization to ingest incoming audit log records.
Without explicit destination permissions, log export calls will be rejected.

Key Concept

Organization Aggregated Log Sinks and Service Account Ingestion Authorization
Estimated Time:1m 30s
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic