Examkin

Question

Difficulty: Very hardMonitoring, Logging, and Observability Integration

A enterprise financial institution requires a centralized logging and observability architecture across all Google Cloud projects within its Organization hierarchy. The architecture must automatically aggregate logs from all present and future projects under the organization folder without manual project-level configuration. Compliance rules require that Administrative Activity audit logs be retained for seven years in an immutable state resistant to deletion, while application and operational logs must be available for real-time querying in BigQuery for 90 days. Furthermore, all log routing destinations must be protected against data exfiltration across perimeter boundaries. Which architectural strategy best satisfies these operational reliability, compliance, and security requirements?

  1. Configure an Organization-level aggregated Log Router sink with an inclusion filter targeting a Pub/Sub topic in a central Security project within a VPC Service Controls perimeter; stream logs from Pub/Sub to BigQuery for real-time analysis and to a Cloud Storage bucket with a locked Bucket Lock Retention Policy for 7-year audit retention.Answer
  2. B
    Implement an aggregate exclusion filter matching `severity < ERROR` on project-level Log Router sinks across all existing projects to reduce log ingestion costs, while exporting remaining audit logs to a standard Cloud Storage bucket.
  3. C
    Assign the primitive Owner role (`roles/owner`) to a central logging service account across all projects, allowing a custom log harvester instance to fetch logs via Cloud Logging API calls and write them directly into BigQuery and Cloud Storage.
  4. D
    Configure project-level Log Router sinks to export logs directly to an external Cloud Storage bucket in a separate project, relying exclusively on IAM object writer permissions without establishing VPC Service Controls perimeters.

Answer

Configure an Organization-level aggregated Log Router sink targeting Pub/Sub in a dedicated security project enclosed within a VPC Service Controls perimeter, streaming to BigQuery for 90-day analytics and to Cloud Storage with a locked Retention Policy for 7-year immutable audit storage.
The solution utilizing an Organization-level aggregated Log Router sink ensures all child projects (present and future) are captured automatically. Streaming through Pub/Sub allows fan-out ingestion into BigQuery for 90-day real-time analytics and into Cloud Storage with Bucket Lock for 7-year immutable compliance storage. Protecting the security project with a VPC Service Controls perimeter satisfies security requirements against data exfiltration.

Step-by-Step Solution

1
Evaluate organization-wide capture requirement
Identify that an Organization-level aggregated Log Router sink (using `includeChildren = true`) is required to automatically capture logs from all current and future projects.
Project-level sinks require manual setup for each new project, failing automated governance requirements.
2
Evaluate long-term audit immutability compliance
Select Cloud Storage with Bucket Lock enabled for 7-year retention.
Bucket Lock enforces retention policies that prevent deletion or modification of objects, satisfying regulatory compliance.
3
Evaluate real-time analytics and security perimeter controls
Route logs through Pub/Sub into BigQuery within a VPC Service Controls perimeter.
Pub/Sub buffers data for multi-destination streaming (BigQuery and Cloud Storage), while VPC Service Controls prevents unauthorized data exfiltration across project boundaries.

Key Concept

Organization-level aggregated log sinks paired with Pub/Sub, BigQuery, immutable Cloud Storage retention policies, and VPC Service Controls perimeters.
Estimated Time:3m 0s
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic