Examkin

Question

Difficulty: HardConfiguring Cloud Logging, Monitoring, and Operational Alerting

An enterprise organization operates hundreds of Google Cloud projects under a single GCP Organization. The security and operations teams require a centralized logging solution to route high-severity audit logs and operational metrics to an on-premises Security Information and Event Management (SIEM) platform via Cloud Pub/Sub in near real-time. The solution must minimize administrative maintenance, apply least-privilege security access control, and capture logs from newly created projects automatically. Which architectural and configuration strategy should the Cloud Architect implement?

  1. Configure an aggregated log sink at the GCP Organization level with an inclusion filter for the required audit and operational logs, set the sink destination to a Pub/Sub topic in a dedicated logging project, and grant the sink's generated writer identity the Pub/Sub Publisher role (roles/pubsub.publisher) on the target topic.Answer
  2. B
    Configure an aggregated log sink at the GCP Organization level, and grant the sink's generated service account writer identity the Editor primitive role (roles/editor) on the central logging project to ensure uninterrupted publishing permissions across all logging resources.
  3. C
    Deploy individual Cloud Logging sinks within each project and grant the operations engineers the Service Account Admin role (roles/iam.serviceAccountAdmin) so they can attach and manage the logging sink service account identity across all target Pub/Sub topics.
  4. D
    Script the provisioning of individual Cloud Logging sinks across all existing projects to export directly to regional Pub/Sub topics without verifying and requesting regional Pub/Sub API quota increases in advance.

Answer

The correct strategy is to configure an aggregated log sink at the GCP Organization level with a Pub/Sub topic destination in a dedicated project and grant the sink's writer identity the Pub/Sub Publisher role (roles/pubsub.publisher) on the target topic.
Configuring an aggregated log sink at the Organization root automatically inherits down the resource hierarchy to catch logs from all present and future projects. Specifying a centralized Pub/Sub topic destination and granting only `roles/pubsub.publisher` to the sink's writer identity satisfies enterprise security compliance, operational automation, and least-privilege access control.

Step-by-Step Solution

1
Evaluate organizational log collection requirements for multi-project management
Identify that creating individual project sinks causes significant administrative overhead and fails to automatically capture logs from future projects. An Organization-level aggregated log sink is required.
Aggregated sinks at the organization root automatically include all current and future child folders and projects.
2
Determine the destination and least-privilege IAM configuration for the log sink
Direct the aggregated sink to a centralized Pub/Sub topic and assign `roles/pubsub.publisher` specifically to the service account writer identity generated by the sink.
Cloud Logging sink export identities require granular permissions (Pub/Sub Publisher) specifically on the destination resource, adhering to IAM least-privilege principles.

Key Concept

Aggregated Cloud Logging Sinks and IAM Security Principles
Estimated Time:2m 0s
Rate this question

Topics

Configuring Cloud Logging, Monitoring, and Operational Alerting