Examkin

Question

Difficulty: MediumMonitoring, Logging, and Observability Integration

An enterprise architecture team is implementing an observability and log management design for an application running on Google Kubernetes Engine (GKE). The team wants to reduce Cloud Logging ingestion costs by preventing verbose application DEBUG logs from being ingested into the `_Default` log bucket, while ensuring that all ERROR-severity application logs and Cloud Audit Logs remain fully available for real-time alerting and compliance export. Which approach correctly achieves this observability strategy without accidentally dropping critical log entries?

  1. Configure an exclusion filter on the `_Default` log bucket specifically matching `resource.type="k8s_container" AND severity="DEBUG"`, while maintaining a Log Router sink to export audit and high-severity logs.Answer
  2. B
    Apply a global log exclusion filter matching `resource.type="k8s_container"` across the entire project to stop container log ingestion into Cloud Logging, relying solely on metric indicators.
  3. C
    Grant the primitive Owner role (`roles/owner`) to the Log Router service account to automatically bypass all log exclusion rules for audit logs.
  4. D
    Configure VPC Service Controls around the GKE cluster and rely on perimeter data boundary rules to stop debug log ingestion into Cloud Logging buckets.

Answer

Configure a fine-grained exclusion filter on the `_Default` log bucket matching `resource.type="k8s_container" AND severity="DEBUG"` alongside Log Router sinks for audit and error log exports.
Configuring a granular exclusion filter on the `_Default` log bucket specifying both `resource.type="k8s_container"` and `severity="DEBUG"` allows high-volume debug logs to be discarded while preserving higher severity logs (such as ERROR) and Cloud Audit Logs for incident response and compliance.

Step-by-Step Solution

1
Analyze cost optimization and reliability logging requirements.
Identified that only verbose DEBUG logs need to be excluded, while ERROR logs and Audit Logs must be retained.
Exclusion filters prevent matching log entries from being ingested into log buckets, avoiding storage and ingestion charges.
2
Evaluate the granularity of log exclusion filters.
Combining `resource.type="k8s_container"` with `severity="DEBUG"` explicitly isolates non-critical debug telemetry.
Overbroad exclusion filters risk inadvertently discarding critical application errors and compliance logs.
3
Verify Log Router sink and security perimeter interaction.
Log Router sinks process logs prior to bucket exclusion rules and IAM/VPC SC controls govern access, not log filtering.
Ensures audit log export and real-time monitoring remain unaffected by bucket-level exclusion filters.

Key Concept

Cloud Logging Log Router Sinks and Exclusion Filters
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic