Examkin

Question

Difficulty: MediumConfiguring Cloud Logging, Monitoring, and Operational Alerting

An enterprise DevOps team needs to collect high-severity application logs across all projects within a Google Cloud folder and publish them to a centralized Pub/Sub topic for real-time automated incident response. The solution must capture only error-level logs and adhere strictly to Google Cloud security best practices and least-privilege access. Which TWO actions should the team take to implement this logging architecture?

  1. Create an aggregated log sink at the folder level with an inclusion filter specifying severity >= ERROR, setting the centralized Pub/Sub topic as the destination.Answer
  2. Grant the Pub/Sub Publisher role (roles/pubsub.publisher) to the writer service account generated by the folder log sink on the target Pub/Sub topic.Answer
  3. C
    Grant the Owner primitive role (roles/owner) to the folder log sink's writer service account on the centralized monitoring project to guarantee log export delivery.
  4. D
    Configure an exclusion filter at the folder level for log entries with severity >= ERROR to prevent duplicate log storage and reduce ingestion overhead.
  5. E
    Grant the Service Account User role (roles/iam.serviceAccountUser) to the operations team on the log sink resource so Cloud Logging can impersonate their user identity.

Answer

To establish real-time centralized error log routing, the enterprise should create a folder-level aggregated log sink configured with an inclusion filter of severity >= ERROR pointing to the Pub/Sub topic, and grant the sink's unique writer service account the Pub/Sub Publisher role (roles/pubsub.publisher) on that topic.
Centralized cross-project logging across a resource hierarchy requires a folder-level aggregated log sink. Setting an inclusion filter for severity >= ERROR ensures that only high-severity operational logs are routed to the central Pub/Sub topic destination. Furthermore, Cloud Logging generates a unique writer service account for the sink; granting this service account the predefined Pub/Sub Publisher role (roles/pubsub.publisher) on the target topic complies with the principle of least privilege.

Step-by-Step Solution

1
Define the aggregated sink at the folder hierarchy
Creating an aggregated log sink at the folder level enables log capture across all child projects in one central configuration.
Folder-level sinks simplify operational monitoring management by aggregating logs across multi-project environments.
2
Apply an inclusion filter for high-severity logs
Setting severity >= ERROR filters out non-critical debug and info logs, focusing processing on actionable operational incidents.
Filtering at the sink level ensures only targeted log entries consume downstream bandwidth and Pub/Sub resources.
3
Grant fine-grained IAM permissions to the sink writer identity
Assigning roles/pubsub.publisher to the writer service account grants precise permissions required to publish to the target Pub/Sub topic.
Following least privilege avoids security risks associated with overly permissive primitive roles.

Key Concept

Aggregated Log Sinks and Least-Privilege IAM Sink Authorization
Rate this question

Topics

Configuring Cloud Logging, Monitoring, and Operational Alerting