Google Professional Cloud DevOps Engineer Question 241
Select 2Google Cloud PlatformYour organization requires all audit logs from Google Cloud resources to be stored in a centralized location for long-term analysis. The logs must also be available for real-time monitoring by the security team. Which combination of services should you configure to meet these requirements?
- A
Export logs to BigQuery for long-term storage and analysis.
- B
Export logs to Cloud Storage with a lifecycle policy for long-term retention.
- C
Export logs to Pub/Sub for real-time processing by the security team.
- D
Export logs to a Cloud SQL database for structured queries.
- E
Use Cloud Monitoring to automatically store and analyze logs.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the requirements, logs should be exported to BigQuery for long-term storage and analysis, as it provides powerful querying capabilities. For real-time monitoring, logs should be exported to Pub/Sub, which enables immediate processing and delivery to the security team. Together, these solutions address both long-term and real-time needs effectively.
- A. Correct.
BigQuery is ideal for long-term storage and analysis of logs due to its querying capabilities and ability to handle large datasets. This meets the requirement for centralized long-term analysis.
- B. Incorrect.
While Cloud Storage can be used for log retention, it is not optimized for querying and analysis. This makes it unsuitable for the requirement of centralized long-term analysis.
- C. Correct.
Pub/Sub is designed for real-time message delivery and processing. Exporting logs to Pub/Sub allows the security team to monitor logs in real-time, fulfilling the real-time monitoring requirement.
- D. Incorrect.
Cloud SQL is not recommended for storing logs due to its limitations in handling large-scale log data and lack of optimized querying for this use case.
- E. Incorrect.
Cloud Monitoring is used for metrics and monitoring but does not serve as a log storage or analysis solution. It cannot fulfill the requirements for centralized storage or real-time processing.