Examkin

Question

Difficulty: MediumMonitoring, Logging, and Observability Integration

An enterprise enterprise architecture team needs to establish a centralized log aggregation strategy across all Google Cloud projects under their organization node. The security and operational teams require high-priority audit logs and application error events to be ingested into a central BigQuery dataset for long-term compliance analysis, while minimizing log ingestion costs by dropping low-priority telemetry. Which logging configuration should the Cloud Architect implement to satisfy these requirements with minimal management effort?

  1. Create an aggregated log sink at the organization level targeting the central BigQuery dataset, configuring an inclusion filter for audit logs and high-severity error events while using exclusion filters for verbose debug logs.Answer
  2. B
    Create an organization-level aggregated log sink targeting BigQuery, but set a global exclusion filter matching severity level ERROR and above to reduce log volume.
  3. C
    Assign the Owner primitive IAM role to a service account that runs custom export scripts on Compute Engine instances to query logs from each project into BigQuery.
  4. D
    Rely exclusively on Cloud IAM bucket permissions across individual projects to isolate logs without configuring VPC Service Controls or centralized Log Router sinks.

Answer

Create an aggregated log sink at the organization level targeting the central BigQuery dataset, configuring an inclusion filter for audit logs and high-severity error events while using exclusion filters for verbose debug logs.
The solution using an organization-level aggregated log sink with targeted inclusion and exclusion filters satisfies central compliance requirements with zero custom maintenance. It automatically captures logs across all projects and exports them to BigQuery while controlling ingestion cost.

Step-by-Step Solution

1
Identify the architectural requirement for multi-project log aggregation.
Recognize that managing individual project sinks scales poorly, whereas an organization-level aggregated sink automatically captures logs across all present and future projects.
Organization-level sinks streamline administration and ensure non-repudiable log collection across the entire resource hierarchy.
2
Determine the appropriate filtering strategy to balance compliance and cost.
Use inclusion filters for high-severity error and audit logs to guarantee critical ingestion into BigQuery, while setting exclusion filters for non-essential debug telemetry.
Exclusion filters prevent costly ingestion of low-value logs without discarding vital security and error records.

Key Concept

Centralized Log Aggregation and Log Router Filtering
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic