Google Professional Cloud Security Engineer Question 444
Select 3Google Cloud PlatformYour organization uses Google Cloud and a third-party SIEM (Security Information and Event Management) system for centralized log analysis. You are tasked with exporting logs from Cloud Logging to the SIEM system in near real-time. Which of the following steps are required to achieve this setup?
- A
Create a Log Sink in Cloud Logging with a destination set to a Pub/Sub topic.
- B
Grant the 'roles/pubsub.publisher' role to the Cloud Logging service account on the Pub/Sub topic.
- C
Configure the SIEM system to pull messages directly from the Cloud Logging API.
- D
Set up a subscription on the Pub/Sub topic and configure the SIEM system to consume messages from the subscription.
- E
Enable the BigQuery Data Transfer Service for log export to the SIEM.
Show answer and explanation
Correct answers: A, B, D
Explanation
To export logs to an external SIEM system, you need to create a Log Sink in Cloud Logging with a Pub/Sub topic as the destination. The 'roles/pubsub.publisher' role must be granted to allow Cloud Logging to publish logs to the Pub/Sub topic. Then, you need to set up a subscription for the Pub/Sub topic, enabling the SIEM system to consume the logs. This process ensures a near real-time log export pipeline.
- A. Correct.
Correct. Creating a Log Sink with a Pub/Sub topic as the destination is the standard way to export logs from Cloud Logging to other systems in near real-time.
- B. Correct.
Correct. Granting the 'roles/pubsub.publisher' role ensures that Cloud Logging can publish log entries to the specified Pub/Sub topic.
- C. Incorrect.
Incorrect. The SIEM system does not directly pull logs from the Cloud Logging API. Logs need to be routed through an intermediary, such as Pub/Sub.
- D. Correct.
Correct. Setting up a subscription on the Pub/Sub topic allows the SIEM system to consume the logs published by Cloud Logging.
- E. Incorrect.
Incorrect. The BigQuery Data Transfer Service is used for transferring data into BigQuery, not for exporting logs to external systems like a SIEM.