Examkin

Soru

Zorluk: ZorConfiguring Cloud Logging, Monitoring, and Operational Alerting

An Site Reliability Engineering (SRE) team is designing a centralized operational observability and compliance log routing framework across an entire Google Cloud Organization. They need to aggregate all admin activity audit logs from all project workloads into a dedicated Security Operations project's BigQuery dataset for long-term retention. Additionally, they must monitor application severity levels and receive real-time notifications whenever high-priority application errors spike across services. Which TWO actions should the team perform to meet these requirements following Google-recommended best practices and least-privilege security principles? (Select TWO.)

  1. Create an organization-level aggregated log sink with an inclusion filter matching audit logs targeting the BigQuery dataset, and grant the sink's service account identity the BigQuery Data Editor (roles/bigquery.dataEditor) role on the target dataset.Cevap
  2. Create a custom log-based metric matching log entries with severity level ERROR or higher, and configure a Cloud Monitoring alerting policy based on the rate of change of this log-based metric.Cevap
  3. C
    Grant the primitive Editor (roles/editor) role to the aggregated log sink's service account on the central Security Operations destination project.
  4. D
    Grant the Service Account Admin (roles/iam.serviceAccountAdmin) role to the operations service account responsible for creating and evaluating metric alert triggers.
  5. E
    Configure an organization-level exclusion filter for severity level ERROR logs to prevent log ingestion fees prior to evaluating log-based metrics.

Cevap

The correct architecture requires creating an organization-level aggregated log sink targeted to the BigQuery dataset with the BigQuery Data Editor role assigned to the sink writer identity, along with creating a custom log-based metric for ERROR severity logs to trigger a Cloud Monitoring alerting policy.
To centralize log retention securely across an entire enterprise, Google Cloud recommends using an organization aggregated log sink targeting a central sink destination (BigQuery dataset) with least-privilege dataset roles (`roles/bigquery.dataEditor`) granted specifically to the sink's generated writer identity. To detect application error spikes in real-time, creating a log-based metric filtered by `ERROR` severity coupled with a Cloud Monitoring alerting policy allows SRE teams to be notified dynamically on metric threshold breaches.

Adım Adım Çözüm

1
Configure Centralized Audit Log Routing
An organization-level aggregated sink captures audit logs across all projects and sends them to the destination BigQuery dataset in the Security Operations project.
Aggregated sinks provide centralized governance without requiring per-project log sink maintenance.
2
Apply Least-Privilege IAM Roles to the Log Sink Identity
The sink's unique writer service account is assigned `roles/bigquery.dataEditor` on the specific destination dataset.
This guarantees the log sink can ingest data into BigQuery without granting broad project-level primitive roles.
3
Define Log-Based Metric and Alerting Policy
A log-based metric tallies log entries with severity `ERROR` or higher, and a Cloud Monitoring alerting policy triggers when the metric exceeds defined threshold rates.
Log-based metrics bridge Cloud Logging data into Cloud Monitoring for operational alerting.

Anahtar Kavram

Organization Log Aggregation, Least-Privilege Sink Service Accounts, and Log-Based Metric Alerting
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Configuring Cloud Logging, Monitoring, and Operational Alerting