Examkin

Question

Difficulty: Very hardConfiguring Cloud Logging, Monitoring, and Operational Alerting

A global healthcare organization is designing a centralized operational logging architecture across hundreds of Google Cloud projects managed under an organizational hierarchy. The observability team needs to collect all high-severity application error logs from every project and stream them to a central Cloud Pub/Sub topic located in a dedicated operational security project for automated incident triage and event processing. The architecture must strictly adhere to Google Cloud security best practices, minimize administrative overhead, and enforce the principle of least privilege. Which configuration strategy should the platform engineering team implement?

  1. Create an aggregated log sink at the organization root with children inclusion enabled, specifying a log filter for error-severity logs and the central Pub/Sub topic as the destination. Grant the log sink's automatically generated writer identity service account the Pub/Sub Publisher role on the central Pub/Sub topic.Answer
  2. B
    Create an aggregated log sink at the organization root, and grant the sink's unique writer identity service account the primitive Editor role on the security operations project to ensure reliable log delivery across all present and future Pub/Sub topics.
  3. C
    Create individual log sinks in each project, construct a custom service account per project, and grant each service account the Service Account Admin role so the log sinks can impersonate the central logging identity.
  4. D
    Configure log exclusion filters across all individual workload projects to drop non-error logs prior to ingestion, and grant the Compute Engine default service account the Pub/Sub Admin role on the destination topic.

Answer

Create an aggregated log sink at the organization root with children inclusion enabled, specifying a log filter for error-severity logs and the central Pub/Sub topic as the destination. Grant the log sink's automatically generated writer identity service account the Pub/Sub Publisher role on the central Pub/Sub topic.
The correct strategy configures an aggregated log sink at the organization root with `includeChildren` set to true. This automatically captures matching logs from all descendant folders and projects. Cloud Logging creates a dedicated writer identity service account for the sink; granting this service account the specific Pub/Sub Publisher role on the destination topic ensures minimal privilege and secure cross-project log routing.

Step-by-Step Solution

1
Define an aggregated log sink at the organization resource level.
Centralizes log ingestion across all existing and newly provisioned folder and project resources using `includeChildren = true`.
Eliminates operational overhead of manually provisioning sinks per project.
2
Configure the sink filter and destination.
Filters logs to export only `severity >= ERROR` entries directly to the target Cloud Pub/Sub topic in the security operations project.
Ensures only relevant operational incidents stream to the automation pipeline.
3
Identify the writer identity service account generated by Cloud Logging and assign least-privilege permissions.
Grant `roles/pubsub.publisher` on the target Pub/Sub topic to the writer identity.
Fulfills Google Cloud Security IAM least-privilege standards by granting topic-level publish rights rather than project-level or primitive roles.

Key Concept

Organization-level Aggregated Log Sinks and Least-Privilege IAM Authorization
Estimated Time:3m 0s
Rate this question

Topics

Configuring Cloud Logging, Monitoring, and Operational Alerting