Examkin

Question

Difficulty: HardMonitoring, Logging, and Observability Integration

An enterprise organization operates hybrid workloads across Compute Engine virtual machines and Google Kubernetes Engine (GKE) clusters. The operations team requires a centralized observability architecture that retains application and system logs for seven years to meet regulatory compliance while enabling real-time alerting for operational anomalies. The architecture must ensure that high-severity logs and security audit trails are guaranteed to be ingested without loss. Which TWO architectural actions should the team implement to fulfill these requirements?

  1. Configure an organization-level aggregated Log Router sink to stream all audit and application logs to a Cloud Storage bucket for long-term compliance storage.Answer
  2. Deploy the Google Cloud Ops Agent on Compute Engine instances and enable native GKE system logging to collect operational metrics and telemetry for real-time Cloud Monitoring alerting.Answer
  3. C
    Apply a broad Log Router exclusion filter matching `severity >= ERROR` across all project log buckets to lower overall Cloud Logging storage costs.
  4. D
    Grant the primitive Owner role (`roles/owner`) to the Log Router sink writer identity on the destination storage sink to ensure uninterrupted log delivery.
  5. E
    Rely solely on Cloud IAM bucket roles without configuring VPC Service Controls perimeters around the central log storage repository.

Answer

The recommended actions are to configure an organization-level Log Router sink pointing to Cloud Storage for compliance retention and to deploy the Ops Agent alongside GKE logging for real-time observability.
Centralized observability for hybrid GCP workloads requires capturing operational telemetry via the Ops Agent on Compute Engine and GKE integrated logging, alongside using an organization-level Log Router aggregated sink to route compliance logs into long-term Cloud Storage buckets.

Step-by-Step Solution

1
Evaluate long-term log retention requirements
Aggregated Log Router sink at the organization level routing logs to a Cloud Storage bucket satisfies multi-year regulatory requirements efficiently.
Cloud Storage provides cheap, durable long-term storage suitable for multi-year compliance audits.
2
Evaluate workload observability and real-time incident detection requirements
Ops Agent on VMs and native GKE logging integration feed Cloud Logging and Cloud Monitoring.
Ops Agent standardizes metric and log capture across VM instances, enabling alerting policies in Cloud Monitoring.
3
Verify security and operational anti-patterns in distractors
Excluding error logs, granting primitive roles, or omitting VPC Service Controls compromise reliability and security.
Exclusion filters on severe errors break incident diagnosis, while excessive IAM roles introduce risk.

Key Concept

Centralized Log Aggregation and Observability Integration
Rate this question

Topics

Monitoring, Logging, and Observability Integration

More questions from this topic