Google Professional Cloud Security Engineer Question 413
Select 3Google Cloud PlatformYour company has a Google Cloud environment with multiple projects hosting critical production workloads. To meet compliance requirements, you need to ensure that all logs, including admin activity logs and data access logs, are being captured and retained for at least 365 days. Additionally, you want to notify the security team immediately if any logs are accidentally disabled. What steps should you take to meet these requirements?
- A
Enable Cloud Audit Logs for all projects and configure retention policies to retain logs for 365 days.
- B
Use an organization policy to enforce logging export configurations and send logs to a centralized Cloud Storage bucket with a 365-day retention policy.
- C
Set up a Log Router sink to export logs to a BigQuery dataset for long-term analysis and compliance reviews.
- D
Create an alert policy in Cloud Monitoring to notify the security team if any changes are made to Log Router configurations.
- E
Enable Cloud Logging's default retention settings, as they automatically meet the 365-day requirement.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet compliance requirements, you must ensure that all logs are captured and retained for at least 365 days. This involves enabling Cloud Audit Logs, using an organization policy to enforce centralized logging export, and configuring retention policies. Additionally, setting up an alert policy in Cloud Monitoring ensures the security team is notified of any changes to logging configurations, helping to mitigate the risk of logs being accidentally disabled. While exporting logs to BigQuery is useful for analysis, it does not inherently address the retention requirement.
- A. Correct.
Correct. Enabling Cloud Audit Logs ensures that critical logs, including admin activity and data access logs, are captured. Configuring retention policies to store logs for 365 days satisfies the compliance requirement.
- B. Correct.
Correct. Using an organization policy to ensure centralized logging export to a Cloud Storage bucket allows for consistent log retention and centralized management. Setting the retention policy on the bucket ensures compliance with the 365-day requirement.
- C. Incorrect.
Incorrect. While exporting logs to BigQuery can be useful for analysis, it does not inherently satisfy the requirement to retain logs for 365 days unless additional retention configurations are applied.
- D. Correct.
Correct. Creating an alert policy in Cloud Monitoring ensures that the security team is notified if any changes are made to Log Router configurations, which could potentially disable logging.
- E. Incorrect.
Incorrect. The default retention settings in Cloud Logging do not meet the 365-day retention requirement for all log types, particularly data access logs, which have a shorter default retention period.