Google Professional Cloud Security Engineer Question 456
Single answerGoogle Cloud PlatformYour organization uses Google Cloud and has multiple projects under a single folder. Security policies mandate that all Cloud Audit Logs, including Admin Activity logs and Data Access logs, must be exported to a centralized logging project for compliance and analysis. You need to configure the required log export while ensuring minimal administrative overhead. What should you do?
- A
Create a log sink at the organization level and configure it to export logs to a Cloud Storage bucket in the centralized logging project.
- B
Create a log sink at the folder level and configure it to export logs to a Cloud Logging bucket in the centralized logging project.
- C
Create individual log sinks for each project under the folder and configure them to export logs to a Pub/Sub topic in the centralized logging project.
- D
Create an aggregated log sink at the folder level and configure it to export logs to a BigQuery dataset in the centralized logging project.
Show answer and explanation
Correct answer: D
Explanation
An aggregated log sink at the folder level is the optimal solution for centralizing logs from multiple projects under a single folder in Google Cloud. This approach simplifies administration by avoiding the need to create individual sinks for each project. Exporting logs to a BigQuery dataset in the centralized logging project aligns with the requirement for compliance and analysis, as BigQuery supports powerful querying and reporting capabilities. This configuration ensures that all relevant logs are captured and exported with minimal effort while meeting organizational security and compliance mandates.
- A. Incorrect.
Creating a log sink at the organization level can centralize logs for all projects, but this approach is not optimal in this scenario as the requirement is specific to projects under a single folder, not the entire organization.
- B. Incorrect.
A folder-level log sink exporting logs to a Cloud Logging bucket is not the best choice because Cloud Logging buckets are primarily used for storage within Logging itself and do not provide the analysis capabilities of BigQuery.
- C. Incorrect.
Creating individual log sinks for each project would work but would require significant administrative effort to manage multiple sinks, which does not meet the requirement for minimal administrative overhead.
- D. Correct.
An aggregated log sink at the folder level is the most appropriate solution as it captures logs for all projects under the folder and consolidates them centrally. Exporting the logs to a BigQuery dataset allows for efficient compliance analysis and querying, meeting both the technical and administrative requirements.