Examkin

Soru

Zorluk: OrtaMonitoring, Logging, and Observability Integration

A multinational logistics company runs workload components across dozens of Google Cloud projects managed under a single Google Cloud Organization. The security operations team requires all Cloud Audit Logs and application error logs from all projects to be centralized in a dedicated compliance Google Cloud project for long-term storage and analysis. Simultaneously, the operations team needs to prevent low-severity debug log ingestion from ballooning operational costs across the organization. Which architectural strategy should a Cloud Architect implement to fulfill these requirements securely and efficiently?

  1. Create an organization-level aggregated Log Router sink with an inclusion filter selecting Cloud Audit Logs and logs with severity of ERROR or higher, pointing to the central project log bucket, and assign the sink service account the Logs Bucket Writer role on the destination resource.Cevap
  2. B
    Configure individual project Log Router sinks in each project with inclusion filters, and grant the sink service accounts the primitive Owner role on the destination project to ensure log delivery bypasses project-level authorization checks.
  3. C
    Configure a project-level default Log Router sink in each project and configure VPC Service Controls perimeter egress rules to automatically forward audit logs to the central project without configuring IAM service account permissions.
  4. D
    Apply a global Cloud Logging exclusion filter at the organization level with the expression 'resource.type=*' to drop all incoming log entries by default, assuming Cloud Audit Logs bypass exclusion filters automatically.

Cevap

Create an organization-level aggregated Log Router sink with an inclusion filter selecting Cloud Audit Logs and logs with severity of ERROR or higher, pointing to the central project log bucket, and assign the sink service account the Logs Bucket Writer role on the destination resource.
Creating an organization-level aggregated Log Router sink enables centralized log aggregation across all existing and future projects within the organization hierarchy. Specifying an inclusion filter for audit logs and error-level messages ensures only required compliance data is routed to the destination project, preventing costs associated with ingesting debug logs. Assigning the specific `roles/logging.bucketWriter` role to the sink service account satisfies security standards through fine-grained identity access.

Adım Adım Çözüm

1
Identify the multi-project log aggregation requirement
Recognize that an organization-level aggregated Log Router sink is required to capture log events across all child projects systematically.
Creating sinks individually in dozens of projects creates administrative overhead and operational inconsistency.
2
Define log filtering to balance compliance and cost optimization
Filter for required logs using inclusion criteria (Cloud Audit Logs and severity >= ERROR) to avoid ingesting low-severity debug logs.
Including only required high-value log types at the sink level prevents low-severity logs from being stored in the central project.
3
Establish secure cross-project identity and access management
Grant the aggregated sink's unique service account the predefined `roles/logging.bucketWriter` role on the target central log bucket.
Google Cloud Log Router uses service accounts to write logs across project boundaries securely under least-privilege principles.

Anahtar Kavram

Organization-level Aggregated Log Router Sinks and Filtering
Bu soruyu puanla

Konular

Monitoring, Logging, and Observability Integration

Bu konudan daha fazla soru