Google Professional Cloud Security Engineer Question 455
Select 2Google Cloud PlatformYou are a Cloud Security Engineer tasked with ensuring all audit logs from multiple Google Cloud projects are stored in a centralized Cloud Storage bucket for compliance purposes. You also need to ensure that only logs with a severity level of 'ERROR' or higher are exported. How should you configure this in Google Cloud?
- A
Create a log sink in each project and specify a filter to include only logs with severity 'ERROR' or higher.
- B
Create an aggregated log sink at the organization level and specify a filter to include only logs with severity 'ERROR' or higher.
- C
Set the destination of the log sink(s) to a centralized Cloud Storage bucket with appropriate permissions.
- D
Enable Cloud Monitoring and configure alerts for logs with severity 'ERROR' or higher instead of exporting logs.
- E
Use a predefined log sink template to automatically export logs from all projects to a centralized Cloud Storage bucket.
Show answer and explanation
Correct answers: B, C
Explanation
To meet the requirement of exporting logs from multiple projects and storing them in a centralized Cloud Storage bucket, you should use an aggregated log sink at the organization level. This approach simplifies management and ensures logs from all projects are captured. Additionally, the sink must have an appropriate destination, such as a Cloud Storage bucket, with the correct permissions. Filters can be applied to the sink to include only logs with a severity of 'ERROR' or higher, ensuring only relevant logs are exported.
- A. Incorrect.
This option would work, but it is not the most efficient solution when dealing with multiple projects. Managing individual log sinks in each project can become complex and error-prone.
- B. Correct.
This is the recommended approach. An aggregated log sink at the organization level can collect logs from all projects within the organization, simplifying management and ensuring comprehensive coverage.
- C. Correct.
Correct. The log sink must have a destination, and setting it to a centralized Cloud Storage bucket ensures that logs are stored in one place for compliance purposes. Proper permissions must be granted to the log sink's service account to write to the bucket.
- D. Incorrect.
This option does not achieve the requirement of exporting logs. While setting up alerts for logs with severity 'ERROR' or higher may be useful for monitoring, it does not fulfill the compliance requirement to store logs in a centralized bucket.
- E. Incorrect.
There is no predefined log sink template in Google Cloud that automatically exports logs from all projects to a centralized bucket. Log sinks must be explicitly created and configured by the user.