Google Associate Cloud Engineer Question 291
Select 2Google Cloud PlatformYour company needs to export all the logs from a Google Cloud project to an external SIEM system for advanced analysis. Which of the following steps should you take to accomplish this task?
- A
Create a sink in Cloud Logging to export logs to a Cloud Storage bucket, then configure the SIEM system to pull logs from this bucket.
- B
Set up a Cloud Pub/Sub topic and configure a sink in Cloud Logging to publish logs to this topic. Then, create a subscription for the SIEM system to receive logs.
- C
Directly configure the SIEM system to read logs from Google Cloud's Stackdriver Logging without any intermediate steps.
- D
Use Cloud Functions to trigger an export of logs to the SIEM system every time a new log entry is created.
Show answer and explanation
Correct answers: A, B
Explanation
Exporting logs to an external SIEM system from Google Cloud involves setting up a mechanism to transport logs. Options such as using Cloud Storage or Cloud Pub/Sub are effective methods to achieve this, as they allow for flexible integration with external systems. Direct access to Cloud Logging by external systems without such mechanisms is not supported, and using Cloud Functions for this purpose is not a standard approach.
- A. Correct.
Correct. Creating a sink in Cloud Logging to export logs to a Cloud Storage bucket is a common method to facilitate log exportation. The SIEM system can then access the logs stored in the bucket.
- B. Correct.
Correct. Cloud Pub/Sub can be used to stream logs to an external system. By setting up a sink to publish logs to a Pub/Sub topic, the SIEM system can subscribe to this topic and receive logs in real-time.
- C. Incorrect.
Incorrect. Stackdriver Logging (now called Cloud Logging) does not support direct reading from external systems without setting up export mechanisms.
- D. Incorrect.
Incorrect. While Cloud Functions can be used for various automation tasks, they are not typically used for directly exporting logs to external systems like a SIEM.