Examkin

Question

Difficulty: Very hardConfiguring Cloud Logging, Monitoring, and Operational Alerting

A financial infrastructure company uses Google Cloud Pub/Sub and Cloud Run to process payment events across multiple Google Cloud projects. During a recent audit, compliance officers discovered that several high-severity payment failure log entries failed to route to the central long-term Cloud Storage sink. An investigation reveals that a developer implemented an aggregate log exclusion filter at the organization level to control ingestion costs, but it accidentally matched critical transaction audit entries. Additionally, an alerting policy monitoring transaction failures using a log-based metric has ceased notifying the incident handling pub/sub topic. How should the principal cloud architect resolve both the missing compliance logs and restore operational alerting while following Google Cloud security best practices?

  1. A
    Modify the organization log exclusion filter using a narrowed boolean evaluation to explicitly match non-compliance log names while allowing payment audit entries, and verify that the custom log-based metric service account holds the Monitoring Notification Channel Editor role.
  2. B
    Remove the exclusion filter entirely across all projects, and grant the primitive Owner role to the Cloud Logging service account associated with the project sink.
  3. Refine the exclusion filter expression to exclude low-severity operational logs while protecting high-severity payment audit logs, and ensure the log-based metric alert condition evaluates non-zero count thresholds properly without relying on elevated administrative service account roles.Answer
  4. D
    Update the exclusion filter to drop all logs matching severity standard INFO, and grant Service Account Admin privileges to the Cloud Monitoring alerting service account.

Answer

Refine the exclusion filter expression to exclude low-severity operational logs while protecting high-severity payment audit logs, and ensure the log-based metric alert condition evaluates non-zero count thresholds properly without relying on elevated administrative service account roles.
The correct solution explicitly refines the log exclusion filter to avoid dropping critical audit records, maintaining compliance retention while avoiding excessive log ingestion costs. It also ensures proper alert threshold evaluation without abusing IAM administrative roles.

Step-by-Step Solution

1
Analyze the log exclusion filter logic in Cloud Logging.
Identify that overbroad regex/boolean filters drop high-severity compliance entries.
Exclusion filters prevent matching log entries from being ingested or routed to downstream sinks.
2
Adjust the exclusion filter regex filter to explicitly target non-critical operational noise while safeguarding audit logs.
Compliance log entries resume routing to the centralized Cloud Storage log sink.
Fine-grained filtering maintains cost control while fulfilling compliance retention policies.
3
Review the IAM identity and alerting policy configuration for the log-based metric.
Confirm metric calculation and alerting threshold parameters without granting primitive or administrative IAM roles.
Ensures alerting continuity while preserving IAM least-privilege requirements.

Key Concept

Cloud Logging Exclusion Filters and Least-Privilege Operational Alerting
Rate this question

Topics

Configuring Cloud Logging, Monitoring, and Operational Alerting