Examkin

Soru

Zorluk: OrtaConfiguring Cloud Logging, Monitoring, and Operational Alerting

An enterprise architecture team is implementing a centralized compliance auditing strategy across their Google Cloud Organization. They need to export all admin activity and data access audit logs from multiple production projects into a single BigQuery dataset hosted in a dedicated security monitoring project. To meet strict security governance guidelines, they must grant minimal necessary permissions to the automated export mechanism. Which configuration approach correctly fulfills these compliance and least-privilege requirements?

  1. Create an organization-level aggregated Cloud Logging sink targeting the destination BigQuery dataset, and grant the sink's writer identity the BigQuery Data Editor role (roles/bigquery.dataEditor) on the target dataset.Cevap
  2. B
    Create an organization-level aggregated Cloud Logging sink targeting the destination BigQuery dataset, and grant the sink's writer identity the primitive Owner role (roles/owner) on the security monitoring project.
  3. C
    Create an organization-level aggregated Cloud Logging sink targeting the destination BigQuery dataset, and assign the Service Account User role (roles/iam.serviceAccountUser) to the engineering team on the sink's writer identity service account.
  4. D
    Submit a regional BigQuery API quota increase request prior to creating an organization-level aggregated Cloud Logging sink, and assign the sink's writer identity the BigQuery Admin role (roles/bigquery.admin) on the project.

Cevap

Create an organization-level aggregated Cloud Logging sink targeting the destination BigQuery dataset, and grant the sink's writer identity the BigQuery Data Editor role (roles/bigquery.dataEditor) on the target dataset.
When exporting logs across projects via Cloud Logging sinks, Cloud Logging provisions a service account writer identity. To adhere to Google Cloud security best practices and least privilege, this writer identity must be granted fine-grained dataset-level permissions—specifically the BigQuery Data Editor role (roles/bigquery.dataEditor)—on the target dataset, rather than broad project-level or primitive roles.

Adım Adım Çözüm

1
Configure Centralized Logging
An organization-level aggregated Cloud Logging sink collects audit logs across all resource hierarchies and routes them to the centralized BigQuery dataset.
Aggregated sinks provide centralized visibility and stream logs efficiently across multi-project organizations.
2
Retrieve Unique Writer Identity
Cloud Logging generates a dedicated service account identity specific to the sink.
Automated log export uses service account identities to authenticate data delivery across project boundaries.
3
Apply Least Privilege Permissions
Grant the BigQuery Data Editor role (roles/bigquery.dataEditor) to the writer identity strictly at the target dataset level.
This grants the exact write permissions required to stream log data into BigQuery tables without exposing broader project-level or administrative access.

Anahtar Kavram

Aggregated Cloud Logging Sinks and Least-Privilege IAM Authorization
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Configuring Cloud Logging, Monitoring, and Operational Alerting