Examkin

Question

Difficulty: MediumMonitoring, Logging, and Observability Integration

An enterprise digital streaming platform hosts its microservices across multiple Google Kubernetes Engine (GKE) clusters and Compute Engine Virtual Machines in separate Google Cloud projects. The SRE team needs to establish a unified observability strategy that consolidates logs and operational metrics for real-time incident analysis, long-term compliance retention, and alerting. The solution must ensure that high-volume, non-critical debug logs do not incur continuous storage charges, while critical security audit and error logs are retained for 365 days and available for real-time alerting. Which architectural approach best fulfills these operational and cost-optimization requirements?

  1. Configure an Organization-level Log Router sink to route audit and error logs to a centralized Cloud Storage bucket with a 365-day retention policy, apply a Cloud Logging exclusion filter on the default log bucket to drop debug logs at ingestion, and establish a multi-project metrics scope in Cloud Monitoring for aggregated operational metrics.Answer
  2. B
    Apply a global Cloud Logging exclusion filter at the organization level filtering out severity level ERROR and above logs to reduce ingestion volume, while granting SRE engineers direct read permissions to individual project log buckets.
  3. C
    Assign the primitive Owner role to the central logging service account across all projects to ensure unrestricted log ingestion, and export all raw debug, application, and audit logs directly to BigQuery without exclusion filters.
  4. D
    Rely strictly on project-level IAM role bindings to prevent engineers from copying log files to external destinations, without configuring VPC Service Controls around the central logging storage resources.

Answer

Configure an Organization-level Log Router sink to route audit and error logs to a centralized Cloud Storage bucket with a 365-day retention policy, apply a Cloud Logging exclusion filter on the default log bucket to drop debug logs at ingestion, and establish a multi-project metrics scope in Cloud Monitoring for aggregated operational metrics.
The optimal solution utilizes an Organization-level Log Router sink for compliance and audit log aggregation, leverages Cloud Logging exclusion filters to prevent expensive non-critical debug logs from being ingested into default storage buckets, and configures Cloud Monitoring multi-project metrics scoping for unified cross-project visibility.

Step-by-Step Solution

1
Analyze log retention and cost optimization requirements.
High-volume debug logs should be excluded from Cloud Logging ingestion using exclusion filters to avoid unnecessary storage costs.
Exclusion filters prevent log entries from being stored in log buckets while allowing selective routing if needed.
2
Design centralized compliance log retention.
Use Organization-level Log Router sinks to aggregate audit and high-severity logs into a centralized Cloud Storage bucket with a 365-day lifecycle/retention policy.
Aggregated sinks at the organization level simplify multi-project compliance logging and ensure centralized governance.
3
Establish cross-project observability.
Set up a multi-project Metrics Scope in Cloud Monitoring.
Metrics Scoping enables SRE teams to monitor, visualize, and alert on metrics across multiple projects from a single workspace.

Key Concept

Centralized Log Router Sinks, Log Exclusion Filters, and Cloud Monitoring Multi-Project Metrics Scoping
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic