Examkin

Question

Difficulty: MediumMonitoring, Logging, and Observability Integration

An enterprise organization operates multiple Google Cloud projects under a single Organization resource. The operations and security teams require a centralized logging and observability solution. They need to aggregate high-severity application errors and security audit logs into a central location for long-term compliance analysis, while simultaneously reducing log ingestion costs by filtering out non-critical debug telemetry from individual projects. Which TWO configuration steps should the Cloud Architect recommend to fulfill these requirements? (Select TWO)

  1. Configure an aggregated Log Router sink at the Organization level with a inclusion filter for audit logs and high-severity events targeted to a central BigQuery dataset.Answer
  2. Configure log exclusion filters on individual project default log sinks to drop debug logs with severity lower than INFO before ingestion.Answer
  3. C
    Create an organization-wide log exclusion filter matching severity >= ERROR to minimize log storage volume across production projects.
  4. D
    Grant the primitive Owner role to the Log Router sink service account on the destination BigQuery dataset to ensure write permissions.
  5. E
    Rely strictly on project IAM permissions without configuring VPC Service Controls to prevent unauthorized log data exfiltration during export.

Answer

The optimal solution requires configuring an aggregated Log Router sink at the Organization level targeting BigQuery for centralized audit compliance, along with log exclusion filters on project default sinks to prevent ingestion of low-severity debug telemetry.
To meet enterprise observability requirements across multiple projects, Google Cloud recommends using an aggregated Log Router sink at the Organization level to route audit and high-priority logs to a centralized BigQuery dataset. Simultaneously, configuring exclusion filters for low-severity logs (severity < INFO) on project sinks prevents ingestion of unnecessary debug telemetry, directly optimizing cost while preserving operational visibility.

Step-by-Step Solution

1
Centralize cross-project audit and high-severity logs.
Create an organization-level aggregated Log Router sink with an inclusion filter targeting BigQuery.
Aggregated sinks capture logs across all projects under the organization resource efficiently.
2
Optimize Cloud Logging ingestion costs.
Apply exclusion filters for severity < INFO on project default log sinks.
Excluding verbose debug logs before ingestion directly controls Cloud Logging costs while preserving essential operational and error logs.

Key Concept

Organization-level aggregated log sinks combined with targeted log exclusion filters satisfy central compliance storage while optimizing log ingestion costs.
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic