Examkin

Question

Difficulty: HardMonitoring, Logging, and Observability Integration

A multinational financial services enterprise runs a multi-project architecture on Google Cloud with strict regulatory audit requirements. The operations team needs to centralize high-severity application errors and Cloud Audit Logs into a dedicated security operations project while optimizing ingestion costs for high-volume debug logs. However, recent incident reviews revealed that essential audit events were omitted because of misconfigured log ingestion rules, and overly permissive access was granted during deployment. Which TWO architecture and log routing strategies should a Cloud Architect implement to guarantee audit log retention, optimize costs, and enforce least-privilege administrative security?

  1. Configure an organization-level aggregated Log Router sink with an explicit inclusion filter for audit logs and high-severity errors, directing stream outputs to BigQuery and Cloud Storage while excluding debug logs using fine-grained exclusion filters that explicitly bypass `_Required` audit logs.Answer
  2. B
    Apply a broad organization-level log exclusion filter matching `severity < ERROR` across all log buckets, including `_Default` and `_Required`, to minimize overall log ingestion cost across all workload projects.
  3. C
    Grant the primitive `roles/owner` role to the Central Security Operations service account across all projects to ensure Log Router sinks can write to target BigQuery datasets without permission errors.
  4. Assign the least-privilege `roles/logging.configWriter` role at the organization level for sink management, and grant the sink service account `roles/bigquery.dataEditor` on the destination datasets.Answer
  5. E
    Rely strictly on project-level IAM roles on Cloud Storage destination buckets to restrict log data access, omitting VPC Service Controls perimeter configurations around the centralized log storage project.

Answer

The correct architecture requires creating an organization-level aggregated Log Router sink with precise inclusion filters that protect audit logs from exclusion, while granting least-privilege IAM roles (`roles/logging.configWriter` and destination-specific writer permissions) to administer logging infrastructure.
The correct strategy combines an organization-level aggregated Log Router sink with targeted filters to retain critical security audit logs while dropping non-essential debug logs, along with fine-grained IAM role assignment (`roles/logging.configWriter` and `roles/bigquery.dataEditor`) to enforce least-privilege security principles.

Step-by-Step Solution

1
Evaluate central log routing requirements across multi-project environments.
Identified that an organization-level aggregated sink is required to capture security and application logs systematically.
Organization-level sinks automatically collect logs from all current and future projects in the hierarchy.
2
Design log inclusion and exclusion filter parameters.
Configured exclusion filters to drop low-severity debug logs while explicitly safeguarding `_Required` audit and high-severity logs.
Overbroad exclusion filters can accidentally drop critical audit logs needed for compliance and security investigations.
3
Enforce least-privilege IAM configurations for sink administration and ingestion.
Assigned `roles/logging.configWriter` for sink creation and specific data writer roles for the destination sink service account.
Primitive roles like Owner introduce severe security risks and exceed functional requirements.

Key Concept

Monitoring, Logging, and Observability Integration
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic