Examkin

Question

Difficulty: EasySecurity Logging, Audit Logs, and Security Command Center

In what sequence should a Cloud Security Architect configure an organization-level aggregated log sink to stream Data Access audit logs from all child projects into a centralized BigQuery dataset within a dedicated logging project?

  1. 1Create the central logging GCP project and provision the target BigQuery dataset.
  2. 2Create the organization-level aggregated log sink with a filter for Data Access audit logs and the --include-children flag.
  3. 3Retrieve the unique writer identity service account name generated by the created log sink.
  4. 4Grant the log sink's writer identity service account the BigQuery Data Editor role on the target BigQuery dataset.

Answer

The correct operational sequence to set up an organization-level aggregated log sink to a central BigQuery dataset is: First, create the central logging project and target BigQuery dataset. Second, create the organization-level log sink configured with the --include-children flag and audit log filter. Third, retrieve the auto-generated writer identity service account for the log sink. Fourth, grant that writer identity service account the BigQuery Data Editor role on the destination dataset.
The proper administrative workflow begins by establishing the central destination resource (BigQuery dataset) in a dedicated project. Next, the organization log sink is created targeting this dataset with the aggregated option enabled, which provisions a dedicated service account writer identity. The service account name must then be retrieved so that the final step—granting the BigQuery Data Editor IAM role on the destination dataset—can be completed to permit log ingestion.

Step-by-Step Solution

1
Provision the destination GCP project and the BigQuery dataset.
A valid target destination URI is created for the sink definition.
Creating a log sink requires a valid, pre-existing destination target.
2
Execute the organization-level sink creation command with the audit log filter and --include-children flag.
The aggregated log sink is established at the organization level and a service account writer identity is generated.
The writer identity service account is created as a direct side effect of provisioning the log sink.
3
Identify the writer identity output from the created log sink.
The unique service account email for the sink is retrieved.
You must know the exact service account identity before granting permissions.
4
Assign the BigQuery Data Editor IAM role on the destination dataset to the log sink writer identity.
Data Access audit logs from all existing and future projects start flowing into BigQuery.
Log sinks write data asynchronously using their unique service account identity, requiring write authorization on the destination resource.

Key Concept

Organization-level aggregated log sink provisioning workflow and service account access control
Estimated Time:1m 0s
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic