Examkin

Question

Difficulty: MediumConfiguring Cloud Logging, Monitoring, and Operational Alerting

An enterprise Site Reliability Engineering (SRE) team needs to route all data access and administrative audit log entries from multiple production Google Cloud projects into a centralized BigQuery dataset for long-term compliance analysis, while also establishing real-time operational alerts when critical application errors captured in the logs exceed an acceptable threshold. The solution must follow Google Cloud security and operational best practices. Which TWO configuration steps should the team perform to achieve this goal?

  1. Create an organization-level aggregated log sink targeted to the central BigQuery dataset destination, and grant the sink's writer identity the BigQuery Data Editor role on the destination dataset.Answer
  2. B
    Assign the primitive Owner role on the centralized BigQuery dataset to the aggregated log sink service account to prevent permission errors during dataset schema creation.
  3. Create a log-based metric in Cloud Logging to extract error occurrences, and configure a Cloud Monitoring alerting policy using the threshold of this metric.Answer
  4. D
    Grant the Service Account Admin role to team members so they can impersonate the log sink service account while building Cloud Monitoring alerting policies.
  5. E
    Configure an exclusion filter on the organization log sink to drop all log entries with a severity of ERROR or higher to reduce ingestion costs.

Answer

The team should create an organization-level aggregated log sink directed to the central BigQuery dataset while granting the sink's writer identity the BigQuery Data Editor role, and create a log-based metric to trigger Cloud Monitoring alerting policies.
The correct architecture uses an organization-level aggregated sink with least-privilege IAM permissions (BigQuery Data Editor) to safely aggregate audit logs into BigQuery, combined with Cloud Logging log-based metrics and Cloud Monitoring alerting policies to trigger real-time operational alerts on critical application error rates.

Step-by-Step Solution

1
Configure centralized log aggregation across all production projects.
An organization-level aggregated log sink routes specified audit log entries across all child projects into a unified BigQuery dataset.
Centralized sinks avoid the operational overhead of configuring individual project sinks.
2
Grant minimum required IAM roles to the sink's writer identity.
The log sink service account receives the BigQuery Data Editor role on the destination dataset.
Least privilege principles mandate using fine-grained predefined roles instead of primitive roles like Owner.
3
Establish real-time metric-based alerting on log error events.
A log-based metric counts error occurrences and feeds into a Cloud Monitoring alerting policy with defined threshold conditions.
Cloud Monitoring requires numeric metrics (derived from logs via log-based metrics) to evaluate alerting conditions and trigger incident notifications.

Key Concept

Centralized Log Aggregation and Log-based Metric Operational Alerting
Rate this question

Topics

Configuring Cloud Logging, Monitoring, and Operational Alerting