Examkin

Question

Difficulty: Very hardMonitoring, Logging, and Observability Integration

A multinational financial enterprise operates hundreds of microservices hosted across multiple Google Cloud projects. The compliance team mandates that all audit and operational logs must be archived for seven years in an immutable state to comply with regulatory standards. Simultaneously, the Security Operations (SecOps) team requires real-time log ingestion into an external Security Information and Event Management (SIEM) platform located in a central security project. During a recent production incident, on-call engineers discovered that crucial application error logs were missing, preventing root cause analysis. Investigation revealed that previous cost-cutting measures introduced aggressive log exclusion configurations. Which TWO architectural and configuration actions should the Cloud Architect recommend to satisfy security compliance, enable real-time SIEM integration, and resolve the missing incident log issue?

  1. Configure an organization-level aggregated Log Router sink with an inclusion filter targeting a Pub/Sub topic in the central SecOps project for SIEM streaming, alongside a secondary sink targeting a Cloud Storage bucket configured with a locked Retention Policy for compliance storage.Answer
  2. Audit existing Cloud Logging exclusion filters across all projects to ensure high-severity ERROR and CRITICAL logs are explicitly exempted from exclusion rules, allowing essential diagnostic telemetry to be ingested.Answer
  3. C
    Create an organization-level log exclusion filter with a wildcard rule matching severity >= ERROR to reduce logging ingestion costs across all child projects, relying on default project sinks for log retention.
  4. D
    Grant the primitive Viewer role (roles/viewer) to the logging service account across all managed projects to bypass exclusion filter restrictions and guarantee full log export visibility.
  5. E
    Rely strictly on standard Cloud Storage IAM object permissions on the log archive bucket without configuring VPC Service Controls or Bucket Lock policies.

Answer

The recommended solution is to configure an organization-level aggregated Log Router sink targeting Pub/Sub for real-time SIEM integration and Cloud Storage with a locked Retention Policy for compliance, while auditing existing log exclusion filters to explicitly preserve ERROR and CRITICAL severity logs.
Combining an organization-level aggregated Log Router sink (targeting Pub/Sub for real-time SIEM streaming and Cloud Storage with Bucket Lock for compliance) with an audit of log exclusion filters satisfies all architectural requirements. Pub/Sub enables decoupled real-time ingestion into SIEM tools, Bucket Lock ensures WORM compliance for seven years, and exempting high-severity logs from exclusion rules ensures critical telemetry is preserved during incidents.

Step-by-Step Solution

1
Analyze Centralized Log Aggregation Requirements
Identify that an organization-level aggregated sink is required to collect logs across all sub-projects without individual project setup.
Organization sinks capture logs comprehensively across the entire GCP resource hierarchy.
2
Determine Ingestion Destinations for Real-Time SIEM and Long-Term Archival
Select Pub/Sub for streaming to external SIEM systems and Cloud Storage with Bucket Lock for 7-year immutable compliance storage.
Pub/Sub provides high-throughput event streaming, whereas Cloud Storage Bucket Lock enforces compliant WORM storage.
3
Address Missing Application Error Logs
Audit and modify existing exclusion filters to ensure ERROR and CRITICAL logs are not discarded during ingestion.
Exclusion filters drop logs prior to ingestion; removing or exempting high-severity logs restores visibility during active incidents.

Key Concept

Monitoring, Logging, and Observability Integration
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic