Examkin

Soru

Zorluk: ZorMonitoring, Logging, and Observability Integration

A global enterprise runs streaming workloads across multiple Google Cloud projects containing Google Kubernetes Engine (GKE) clusters and Compute Engine instances. The central Site Reliability Engineering (SRE) and security teams require a centralized observability pipeline. Specifically, high-severity security audit logs must be retained long-term in BigQuery for regulatory compliance, while operational application error logs must be routed in real time to an external Security Information and Event Management (SIEM) system via Cloud Pub/Sub. To optimize logging costs, ensure minimal log ingestion overhead, and enforce proper access security without dropping critical events, which TWO configuration steps should the cloud architect implement? Select TWO.

  1. Create an organization-level aggregated Log Router sink specifying BigQuery as the destination, filtered to include specific audit and error log types, and configure a table retention policy.Cevap
  2. Configure a Log Router sink with a real-time error log filter targeting a Cloud Pub/Sub topic, and grant the sink's writer service account the Pub/Sub Publisher role on that topic.Cevap
  3. C
    Apply a global Cloud Logging exclusion filter with the query `severity >= ERROR` across all projects to suppress high-volume error log ingestion into Cloud Logging storage buckets.
  4. D
    Grant the primitive Owner role to the Log Router writer service accounts in each project to guarantee write permission to cross-project BigQuery datasets and Pub/Sub topics.
  5. E
    Rely exclusively on Identity and Access Management (IAM) role bindings on the log sinks to prevent unauthorized users from exfiltrating log data to external Cloud Storage buckets.

Cevap

The optimal architecture combines an organization-level aggregated Log Router sink targeting BigQuery for long-term compliance archiving, and a targeted Log Router sink sending error logs to Cloud Pub/Sub with fine-grained IAM Publisher permissions assigned to the sink service account.
Centralizing long-term audit log retention is best accomplished using an organization-level aggregated Log Router sink pointing to BigQuery. For real-time SIEM streaming, routing targeted error logs to a Pub/Sub topic while assigning the minimal necessary `Pub/Sub Publisher` role to the sink service account ensures secure, low-latency log export.

Adım Adım Çözüm

1
Aggregate logs at scale for centralized compliance
Creating an organization-level aggregated Log Router sink captures audit and compliance log data across all GCP projects into a central BigQuery dataset.
Centralized sinks remove the administrative burden of configuring individual sinks per project and enforce organization-wide auditing compliance.
2
Configure real-time log export with least privilege access
Setting up a dedicated sink for error logs to a Cloud Pub/Sub topic and granting `roles/pubsub.publisher` to the sink's service account enables real-time SIEM stream ingestion while adhering to security best practices.
Pub/Sub provides low-latency streaming export, and granular IAM role assignment prevents excessive permissions.

Anahtar Kavram

Organization-wide Log Router aggregation, destination sink permissions, and security controls.
Bu soruyu puanla

Konular

Monitoring, Logging, and Observability Integration

Bu konudan daha fazla soru