Examkin

Soru

Zorluk: OrtaViewing and Analyzing Cloud Audit Logs

An organization requires all Cloud Audit Logs from a production project to be exported to a central BigQuery dataset in a dedicated security project for long-term retention and analysis. Which TWO of the following configurations are required to complete this log routing setup successfully? Select two.

  1. Create a log sink in the production project specifying the BigQuery dataset as the destination.Cevap
  2. Grant the log sink's writer service account the BigQuery Data Editor role on the destination dataset.Cevap
  3. C
    Assign the primitive Owner role to the log sink writer identity at the organization level.
  4. D
    Enable Uniform Bucket-Level Access on the destination BigQuery dataset to permit sink writes.

Cevap

Exporting Cloud Audit Logs to an external BigQuery dataset requires creating a log sink in the source project configured with the BigQuery destination URI, and granting the sink's generated writer service account the BigQuery Data Editor role on the target dataset.
To route Cloud Audit Logs across projects to BigQuery, a log sink must be configured in the source project pointing to the target BigQuery dataset. Additionally, Cloud Logging provisions a dedicated writer identity (service account) for the sink, which must be granted the BigQuery Data Editor role on the destination BigQuery dataset to authorize table creation and log entry writes.

Adım Adım Çözüm

1
Define the export route
A log sink is created in the production project pointing to the target BigQuery dataset URI.
Log sinks filter and route incoming audit logs to supported external destinations.
2
Retrieve writer identity
Cloud Logging automatically generates a unique service account identity (writerIdentity) for the sink.
Log sinks authorize writes using service account impersonation rather than user credentials.
3
Configure destination permissions
The BigQuery Data Editor role (roles/bigquery.dataEditor) is granted to the sink's writer service account on the target dataset.
The service account requires explicit write access to stream audit log entries into BigQuery tables.

Anahtar Kavram

Routing Cloud Audit Logs to BigQuery using Log Sinks and Service Account Identities
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Viewing and Analyzing Cloud Audit Logs

Bu konudan daha fazla soru