Examkin

Question

Difficulty: MediumMonitoring, Logging, and Observability Integration

An enterprise organization operates multiple microservice workloads across Google Kubernetes Engine (GKE) and Compute Engine. The cloud operations team needs to centralize operational observability while optimizing logging ingestion costs. They want to filter out non-essential debug logs from storage while ensuring high-severity application errors and security audit logs are reliably preserved for incident investigation. Which log routing design best meets these observability and reliability requirements?

  1. Configure an aggregated Log Router sink at the organization level with explicit inclusion filters targeting severity levels of ERROR and above, while applying fine-grained exclusion filters for low-severity debug logs before exporting to a centralized BigQuery dataset.Answer
  2. B
    Configure an organization-level log exclusion filter that matches severity level ERROR and above to prevent high-volume error logs from consuming storage quotas during operational outages.
  3. C
    Apply a broad organization-level log exclusion filter across all projects and grant primitive Owner roles to operation engineers so they can manually disable filters during active incidents.
  4. D
    Set up centralized log export sinks and rely exclusively on standard IAM roles to control log access, omitting VPC Service Controls around the central log storage destination.

Answer

Configure an aggregated Log Router sink at the organization level with explicit inclusion filters targeting severity levels of ERROR and above, while applying fine-grained exclusion filters for low-severity debug logs before exporting to a centralized BigQuery dataset.
Configuring an aggregated Log Router sink with targeted inclusion filters for ERROR severity logs and explicit exclusions for debug logs ensures that critical telemetry is centrally preserved for analysis while optimizing overall storage costs.

Step-by-Step Solution

1
Analyze logging and observability requirements
Identified the need to retain high-severity error and security audit logs while reducing storage costs by eliminating non-essential debug telemetry.
Observability requires reliable access to error logs during incidents without incurring unnecessary ingestion costs for debug logs.
2
Evaluate GCP Log Router capabilities
Log Router sinks with inclusion and fine-grained exclusion filters allow organization-wide aggregated routing.
Filtering at ingestion prevents unwanted log storage while ensuring high-priority diagnostic logs flow to central storage.
3
Select the optimal architecture
An aggregated sink with severity-based inclusion and targeted debug exclusion achieves both cost control and observability reliability.
This strategy maintains complete visibility into errors and security events without risking log loss or compliance violations.

Key Concept

Monitoring, Logging, and Observability Integration
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic