Google Associate Cloud Engineer Question 290
Select 3Google Cloud PlatformYou are a Google Cloud Engineer tasked with setting up a logging export system for your company's Google Cloud environment. The goal is to export logs from Cloud Logging to an external SIEM system for advanced analysis. Which of the following steps are necessary to achieve this?
- A
Create a sink in Cloud Logging with a destination set to a Pub/Sub topic.
- B
Set up a Cloud Storage bucket as the sink's destination.
- C
Configure the external SIEM system to pull logs from the Pub/Sub topic.
- D
Grant the appropriate permissions to the Pub/Sub topic to allow the SIEM system to access it.
- E
Use Cloud Functions to transform the logs before exporting.
- F
Schedule a Cloud Scheduler job to initiate log exports.
Show answer and explanation
Correct answers: A, C, D
Explanation
Exporting logs from Cloud Logging to an external system like a SIEM involves setting up a sink with a Pub/Sub topic destination, configuring the SIEM to pull from this Pub/Sub topic, and ensuring the right permissions are in place for access. This setup allows for efficient and real-time log data export, which is often a requirement for security and monitoring solutions.
- A. Correct.
Creating a sink in Cloud Logging with a destination set to a Pub/Sub topic is a common practice for exporting logs to external systems.
- B. Incorrect.
While Cloud Storage can be used as a sink destination, it is not the best choice for real-time log export to an SIEM system, which often requires Pub/Sub for near real-time data streaming.
- C. Correct.
Configuring the external SIEM system to pull logs from the Pub/Sub topic is crucial because it enables the SIEM system to receive logs as they are published.
- D. Correct.
Granting the appropriate permissions to the Pub/Sub topic ensures that the external SIEM system can access the logs.
- E. Incorrect.
Using Cloud Functions is not necessary in this scenario unless log transformation is specifically required, which is not mentioned in the requirements.
- F. Incorrect.
Cloud Scheduler is not used for exporting logs; it is typically used for triggering jobs or functions on a schedule.