Examkin

Soru

Zorluk: ZorMonitoring, Logging, and Observability Integration

An enterprise organization operates a multi-project Google Cloud environment hosting business-critical microservices. The central operations team needs to aggregate high-severity application logs and system audit logs across all projects into a centralized observability project for analysis and compliance. Concurrently, the team must optimize Cloud Logging ingestion costs by suppressing high-volume, routine container runtime logs without risking the loss of critical failure events or audit records. Which TWO actions should the Cloud Architect recommend to satisfy these observability and cost optimization requirements? (Select TWO)

  1. Configure an aggregated log sink at the GCP Organization level with an inclusion filter targeting log severity WARNING and above, routing the log entries to a designated Log Bucket or BigQuery dataset in the central observability project.Cevap
  2. Configure log exclusion filters on workload projects specifically targeting low-severity INFO and DEBUG messages, while explicitly preserving ERROR, CRITICAL, and audit log entries.Cevap
  3. C
    Apply a broad log exclusion filter with severity >= ERROR across workload projects to prevent high-severity logs from incurring ingestion charges in Cloud Logging.
  4. D
    Grant the primitive roles/owner role on the central observability project to the service account automatically created for the organization-level log sink.
  5. E
    Rely exclusively on project-level IAM viewer permissions to prevent unauthorized extraction of centralized logs without implementing VPC Service Controls perimeters.

Cevap

The correct recommendations are to configure an aggregated log sink at the GCP Organization level targeting severity WARNING and above to route logs centrally, and to apply fine-grained exclusion filters targeting routine low-severity logs (INFO/DEBUG) while preserving critical error and audit logs.
The correct strategy combines organization-level aggregated sinks with targeted log exclusions. Organization-level aggregated sinks allow automatic aggregation of matching telemetry across all current and future projects into a centralized observability project. Paired with precise log exclusion filters that drop only high-volume, low-severity streams (like INFO and DEBUG), the architecture optimizes Cloud Logging ingestion costs while maintaining full visibility into system errors, warnings, and security audit trails.

Adım Adım Çözüm

1
Evaluate central log collection across multiple GCP projects.
Identify that an Organization-level aggregated log sink is the GCP recommended pattern for centralized ingestion.
Creating log sinks at the Organization root avoids fragmented per-project configuration and ensures uniform audit/log capture.
2
Evaluate log cost optimization strategies without dropping operational signals.
Identify that log exclusion filters must target high-volume, low-severity log levels (such as INFO and DEBUG).
Excluding routine informational logs reduces ingestion volume while ensuring error and critical severity logs pass through to monitoring and alerting pipelines.
3
Analyze security and compliance requirements for the log sink service account.
Reject primitive IAM role assignments in favor of granular writer roles, and ensure perimeter security controls protect log destinations.
Following security best practices prevents over-privileged service accounts and guards against data exfiltration.

Anahtar Kavram

Centralized Log Aggregation and Log Exclusion Filters
Bu soruyu puanla

Konular

Monitoring, Logging, and Observability Integration

Bu konudan daha fazla soru