Examkin

Question

Difficulty: HardConfiguring Cloud Logging, Monitoring, and Operational Alerting

A security compliance team requires all Data Access audit logs across an entire Google Cloud Organization to be aggregated and streamed in real time to a centralized Pub/Sub topic residing within a dedicated security management project. The solution must adhere strictly to Google Cloud security best practices and the principle of least privilege. Which TWO actions must a cloud architect perform to configure this organization-level log export?

  1. Create an aggregated log sink at the GCP Organization level with a filter for Data Access audit logs, setting the destination to the central Pub/Sub topic and enabling the include_children parameter.Answer
  2. Grant the Pub/Sub Publisher role (roles/pubsub.publisher) on the target Pub/Sub topic to the unique writer identity service account generated by the organization log sink.Answer
  3. C
    Grant the Owner primitive role (roles/owner) on the organization resource to the log sink service account so it has full permission to write logs across projects.
  4. D
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the log sink service account in the destination project to enable log ingestion impersonation.
  5. E
    Submit a request for a regional quota increase for Cloud Logging ingestion API throughput prior to creating the aggregated organization sink.

Answer

To configure centralized organization-wide audit log streaming securely, you must create an aggregated organization-level log sink with include_children enabled and grant the sink's generated writer identity service account the Pub/Sub Publisher role on the target Pub/Sub topic.
The solution requires aggregated log collection across an entire GCP Organization hierarchy and least-privilege destination authorization. Creating an organization-level sink with `include_children = true` captures logs from all child folders and projects. Granting `roles/pubsub.publisher` to the sink's unique writer identity directly on the target Pub/Sub topic ensures least-privilege access.

Step-by-Step Solution

1
Define the aggregated sink at the organization root.
Configuring the sink at the organization level with `include_children = true` ensures child folders and projects automatically export their Data Access audit logs.
Organization-level log aggregation requires explicit inclusion of child resources to cover all projects.
2
Identify the writer identity of the organization sink.
Cloud Logging creates a service account identity specifically assigned to manage data export for that sink.
Log sink exports rely on service account authorization to access external destinations.
3
Grant minimum permissions on the target Pub/Sub topic.
Assigning `roles/pubsub.publisher` on the specific Pub/Sub topic allows the sink service account to publish log entries while respecting least privilege.
The service account requires pub/sub publishing capabilities limited strictly to the target resource.

Key Concept

Organization Aggregated Log Sinks and Least-Privilege IAM Routing
Estimated Time:2m 0s
Rate this question

Topics

Configuring Cloud Logging, Monitoring, and Operational Alerting