Google Professional Cloud Security Engineer Question 454
Select 2Google Cloud PlatformYour organization needs to export all Cloud Audit Logs from multiple Google Cloud projects to a centralized logging bucket in a different project for compliance purposes. As a Professional Cloud Security Engineer, you are tasked with ensuring this configuration. Which of the following steps must you take to correctly set up the log export using aggregated sinks?
- A
Create an aggregated log sink in one of the projects and select the desired log types to export.
- B
Assign the required Identity and Access Management (IAM) permissions to allow the aggregated sink to write logs to the centralized logging bucket.
- C
Ensure that the centralized logging bucket is located in the same region as the source logs.
- D
Use a unique filter in the aggregated sink to include all logs from the desired projects.
- E
Enable the Cloud Logging API only in the project hosting the centralized logging bucket.
Show answer and explanation
Correct answers: B, D
Explanation
To export logs from multiple projects to a centralized bucket, you need to use an aggregated log sink at the organization or folder level. Proper IAM permissions (e.g., roles/logging.logWriter) must be assigned to allow the sink to write to the centralized bucket. Additionally, a filter must be applied in the aggregated sink to include logs from the desired projects. The location of the centralized bucket does not have to match the region of the source logs, and the Cloud Logging API must be enabled in all the source projects, not just the target project.
- A. Incorrect.
Incorrect. Aggregated log sinks are created at the organization or folder level, not at the individual project level. Creating a sink in one project will not aggregate logs across multiple projects.
- B. Correct.
Correct. The log sink requires the necessary IAM permissions (e.g., roles/logging.logWriter) to write logs to the centralized bucket.
- C. Incorrect.
Incorrect. The centralized logging bucket does not need to be in the same region as the source logs. Buckets can receive logs from any region.
- D. Correct.
Correct. Aggregated sinks use filters to include logs from multiple projects, folders, or organizations, so configuring a filter to include all desired logs is essential.
- E. Incorrect.
Incorrect. The Cloud Logging API must be enabled in all projects where logs are being exported from, not just the centralized bucket project.