Examkin

Soru

Zorluk: KolayMonitoring, Logging, and Observability Integration

A cloud architect needs to consolidate all Administrative Activity audit logs from all projects within a Google Cloud organization into a centralized BigQuery dataset for compliance auditing. Which approach represents the recommended Google Cloud observability integration pattern while following security best practices?

  1. Create an aggregated Log Router sink at the organization level targeting the BigQuery dataset, and grant the sink's service account the BigQuery Data Editor role on the destination dataset.Cevap
  2. B
    Create an aggregated Log Router sink at the organization level, and grant the sink's service account the primitive Owner role on the target BigQuery project to guarantee write access.
  3. C
    Create an aggregated Log Router sink at the organization level, and add an exclusion filter matching severity >= NOTICE to minimize BigQuery ingestion costs.
  4. D
    Grant auditors standard IAM Viewer permissions across all projects to review logs in the Cloud Logging console without creating an aggregated sink, relying on IAM alone for data protection.

Cevap

Create an aggregated Log Router sink at the organization level targeting the BigQuery dataset, and grant the sink's service account the BigQuery Data Editor role on the destination dataset.
Aggregated Log Router sinks created at the Google Cloud organization resource level automatically gather log entries from all projects under the organization and export them to a designated target such as BigQuery. Granting the BigQuery Data Editor role to the sink's service account provides the minimum permissions necessary to write log entries to the destination table.

Adım Adım Çözüm

1
Identify the architectural requirement for multi-project audit log centralization.
An aggregated Log Router sink at the organization level is required to capture logs from all child projects.
Organization-level log sinks automatically capture logs across all current and future projects in the resource hierarchy.
2
Select the appropriate destination and access control policy.
Route logs to BigQuery and grant the sink's identity the least-privilege role (BigQuery Data Editor).
Predefined roles avoid granting unnecessary administrative privileges associated with primitive roles.

Anahtar Kavram

Aggregated Log Router Sinks and Least-Privilege IAM Integration
Bu soruyu puanla

Konular

Monitoring, Logging, and Observability Integration

Bu konudan daha fazla soru