Google Associate Cloud Engineer Question 292
Select 2Google Cloud PlatformYour company has a requirement to export logs from Google Cloud Logging to an external SIEM system for advanced analysis and compliance. Which of the following steps must you perform to set up the logs export correctly?
- A
Create a sink in Google Cloud Logging and specify a Cloud Storage bucket as the destination.
- B
Create a sink in Google Cloud Logging and specify a Pub/Sub topic as the destination.
- C
Grant the Pub/Sub Publisher role to the Cloud Logging service account on the specified Pub/Sub topic.
- D
Configure the external SIEM system to pull logs directly from Google Cloud Logging.
- E
Create a sink in Google Cloud Logging and specify a BigQuery dataset as the destination.
Show answer and explanation
Correct answers: B, C
Explanation
To export logs to an external SIEM system, you should create a sink in Google Cloud Logging that routes logs to a Pub/Sub topic. Then, grant the necessary permissions to allow the Cloud Logging service to publish logs to this topic. This setup facilitates streaming logs to the SIEM system, which can pull logs from the Pub/Sub topic for further analysis.
- A. Incorrect.
This option is incorrect for sending logs to an external SIEM system, as specifying a Cloud Storage bucket is suitable for storage, not direct SIEM integration.
- B. Correct.
This option is correct because creating a sink with a Pub/Sub topic as the destination allows for streaming logs to external systems.
- C. Correct.
This option is correct because granting the Pub/Sub Publisher role to the Cloud Logging service account enables it to publish logs to the specified Pub/Sub topic.
- D. Incorrect.
This option is incorrect because Google Cloud Logging does not support direct pull integration by external systems.
- E. Incorrect.
This option is incorrect for sending logs to an external SIEM system, as specifying a BigQuery dataset is suitable for analysis within Google Cloud, not external integration.