Google Professional Cloud Security Engineer Question 442
Single answerGoogle Cloud PlatformYour organization uses a SIEM (Security Information and Event Management) system for centralized security monitoring. You are tasked with exporting logs from Google Cloud Logging to the SIEM system in real time. What is the best approach to achieve this while ensuring scalability and minimal latency?
- A
Use a BigQuery Data Transfer Service to export logs to the SIEM system.
- B
Configure a log sink in Cloud Logging to stream logs to a Pub/Sub topic, and then set up a subscriber to forward logs to the SIEM system.
- C
Manually download logs from Cloud Logging in batch and upload them to the SIEM system.
- D
Set up a Cloud Function to query Cloud Logging periodically and forward logs to the SIEM system.
Show answer and explanation
Correct answer: B
Explanation
To export logs to an external system like a SIEM in real time, the most efficient and scalable approach is to configure a log sink in Cloud Logging that streams logs to a Pub/Sub topic. The Pub/Sub topic can then deliver the logs to the SIEM system via a subscriber. This architecture ensures low latency, high availability, and scalability, which are critical for security monitoring use cases.
- A. Incorrect.
BigQuery Data Transfer Service is designed for scheduled data transfers and is not suitable for real-time log streaming to external systems.
- B. Correct.
Using a log sink to stream logs to a Pub/Sub topic ensures real-time delivery to the SIEM system. The Pub/Sub topic acts as a scalable and reliable intermediary, allowing the SIEM system to handle logs efficiently.
- C. Incorrect.
Manually downloading logs is not scalable or automated, and this approach introduces significant latency and resource overhead.
- D. Incorrect.
Querying Cloud Logging periodically with a Cloud Function introduces delays and is less efficient compared to streaming logs directly via a log sink.