Examkin

Soru

Zorluk: OrtaMonitoring and Logging

A security compliance team needs to aggregate and retain all admin activity audit logs from every Google Cloud project residing within a specific organizational Folder. The logs must be streamed into a central BigQuery dataset located in a dedicated security project for long-term analysis. You need to configure this aggregated log export while adhering to the principle of least privilege. Which TWO actions should you perform? (Select 2 answers.)

  1. Create an aggregated Log Router sink at the Folder level with the destination configured to point to the central BigQuery dataset.Cevap
  2. Grant the BigQuery Data Editor role to the sink's writer identity service account on the destination BigQuery dataset.Cevap
  3. C
    Enable the Cloud Logging API at the Folder container level using gcloud commands before creating the sink.
  4. D
    Grant the primitive Owner role to the sink writer identity across the entire destination security project.

Cevap

The correct actions are to create an aggregated Log Router sink at the Folder level pointing to the destination BigQuery dataset, and to grant the BigQuery Data Editor role to the sink's writer identity service account specifically on the target dataset.
Aggregated Cloud Logging sinks created at a folder level automatically collect log entries from all child projects within that folder. Furthermore, granting the predefined role of BigQuery Data Editor to the sink's writer identity on the target BigQuery dataset enforces least privilege while providing the necessary write permissions for ingestion.

Adım Adım Çözüm

1
Identify the resource hierarchy level for log aggregation
To aggregate audit logs from multiple projects under a folder, an aggregated sink must be created at the Folder resource level.
Project-level sinks only collect logs within their own project boundaries, whereas folder-level sinks can include logs across child projects.
2
Configure destination permission using least privilege
Assign the BigQuery Data Editor role to the sink's writer identity on the destination dataset.
Log Router sinks use a service account (writer identity) to publish logs into cross-project destinations, which requires granular permissions on the target resource.

Anahtar Kavram

Aggregated Log Router Sinks and Cross-Project IAM Permissions
Bu soruyu puanla

Konular

Monitoring and Logging

Bu konudan daha fazla soru