Examkin

Question

Difficulty: HardMonitoring, Logging, and Observability Integration

An enterprise financial organization runs microservice workloads across multiple Google Cloud projects in an organization. The security operations team requires all Data Access Audit Logs and application error logs to be streamed in real-time to a centralized security telemetry project for compliance auditing and threat detection. However, high-volume HTTP request logs and operational INFO logs must be excluded to prevent excessive Cloud Logging ingestion costs. The lead architect creates an organization-level Log Router sink targeting a Pub/Sub topic in the central project. How should the architect configure the Log Router sink and permissions to fulfill these requirements securely without dropping essential security logs?

  1. Configure an inclusion filter matching logName containing 'cloudaudit.googleapis.com/data_access' OR severity >= ERROR, and grant the Log Router unique service account the roles/pubsub.publisher role on the target Pub/Sub topic.Answer
  2. B
    Configure a broad sink filter capturing all logs, but add an exclusion filter with severity <= INFO, and grant the Log Router unique service account the primitive Owner role on the centralized security project.
  3. C
    Configure an inclusion filter for all organizational logs, grant the Log Router service account the roles/editor role on the destination project, and rely on BigQuery view filters after log export to drop unwanted logs.
  4. D
    Configure the inclusion filter for audit and error logs, grant the Pub/Sub Publisher role, but rely strictly on IAM roles to prevent unauthorized cross-project egress without configuring VPC Service Controls perimeters.

Answer

Configure an inclusion filter matching logName containing 'cloudaudit.googleapis.com/data_access' OR severity >= ERROR, and grant the Log Router unique service account the roles/pubsub.publisher role on the target Pub/Sub topic.
The correct approach uses explicit inclusion filters to capture specific audit log types (Data Access Audit Logs) along with high-severity application errors (severity >= ERROR). This prevents low-severity noise from being ingested while ensuring audit records (which may have NOTICE or DEFAULT severity) are retained. Additionally, granting the predefined Pub/Sub Publisher role to the sink's dedicated service account adheres strictly to the principle of least privilege.

Step-by-Step Solution

1
Define inclusion filter criteria for centralized log routing.
Specifying precise log names ('cloudaudit.googleapis.com/data_access') alongside explicit severity thresholds (severity >= ERROR) ensures only mandatory compliance and incident management logs are ingested.
Cloud Audit Logs often carry DEFAULT or NOTICE severity levels. Using an inclusion filter targeted specifically at log types avoids dropping mandatory non-error audit records.
2
Configure identity and access management for cross-project log sinks.
Granting `roles/pubsub.publisher` directly to the writer identity (service account) generated by the organization-level sink on the destination Pub/Sub topic enables secure cross-project ingestion.
Least privilege principles dictate granting resource-specific predefined roles rather than primitive project-level roles such as Owner or Editor.

Key Concept

Organization Log Router Sinks and Cloud Audit Logging Ingestion Optimization
Estimated Time:2m 0s
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic