A multinational financial services company operates multiple Google Cloud projects across several business units organized under a single Google Cloud organization. To meet strict regulatory mandates and ensure auditability, the security and compliance team has established the following architecture requirements: All Cloud Audit Logs across all existing and future projects must be collected centrally. Audit logs must be retained for seven years in a cost-effective, tamper-resistant storage format for forensic analysis. The log data at rest must strictly reside within a specific geographic region (europe-west3) to comply with national data residency regulations. Real-time copies of high-severity security audit events must be forwarded immediately to an external, on-premises Security Information and Event Management (SIEM) system. Which logging architecture should you design to fulfill these requirements?

Create an organization-level aggregated log sink that routes all audit logs to a regional Cloud Storage bucket located in `europe-west3`, and configure a second aggregated log sink that filters high-severity security events to a Pub/Sub topic to stream logs to the external SIEM.: ### What this solution is This architecture uses **organization-level aggregated log sinks** in **Cloud Logging** to automatically capture audit logs from all current and future child projects. It routes long-term audit records to a regionally bound **Cloud Storage bucket** while routing real-time security events to a **Pub/Sub topic** for external SIEM streaming. ### How it meets the requirements - **Centralized Collection Across Projects**: An **organization-level aggregated sink** automatically captures logs originating from all folders and projects within the organization hierarchy without requiring per-project sink maintenance. - **Data Residency Compliance**: Configuring the destination **Cloud Storage bucket** explicitly in the `europe-west3` region guarantees that data at rest stays within the specified geographic boundary. - **Cost-Effective Long-Term Retention**: **Cloud Storage** provides low-cost, durable JSON object storage suitable for multi-year regulatory retention and post-incident forensic retrieval. - **Real-Time SIEM Integration**: A separate sink routing filtered high-severity events to **Pub/Sub** enables asynchronous, low-latency streaming to third-party or on-premises SIEM platforms. ### Key advantages - **Scalable Governance**: Automatically captures logs from newly created projects within the organization. - **Storage Optimization**: Allows configuring **Object Lifecycle Management** and **Bucket Lock** (retention policies) on Cloud Storage for compliance. - **Decoupled Delivery**: Pub/Sub provides a robust buffer for external integration without impacting log storage in Google Cloud.

StudyCerts

Centralized Audit Log Export Retention Residency | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Centralized Audit Log Export Retention Residency

Section: Audits (including logs)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A multinational financial services company operates multiple Google Cloud projects across several business units organized under a single Google Cloud organization. To meet strict regulatory mandates and ensure auditability, the security and compliance team has established the following architecture requirements:

All Cloud Audit Logs across all existing and future projects must be collected centrally.
Audit logs must be retained for seven years in a cost-effective, tamper-resistant storage format for forensic analysis.
The log data at rest must strictly reside within a specific geographic region (europe-west3) to comply with national data residency regulations.
Real-time copies of high-severity security audit events must be forwarded immediately to an external, on-premises Security Information and Event Management (SIEM) system.

Which logging architecture should you design to fulfill these requirements?

Create an organization-level aggregated log sink that routes all audit logs to a regional Cloud Storage bucket located in europe-west3, and configure a second aggregated log sink that filters high-severity security events to a Pub/Sub topic to stream logs to the external SIEM.

Configure project-level log sinks in each project routing audit logs to a linked BigQuery dataset located in europe-west3, and export daily snapshots to Cloud Storage using BigQuery Data Transfer Service.

Create an organization-level aggregated log sink directing audit logs to a multi-region BigQuery dataset in Europe, and configure Eventarc triggers to batch export audit logs to the external SIEM.

Configure the default _Required log bucket in each project to retain logs for seven years, and run a scheduled Cloud Run job that queries the Logs API hourly to push events to Cloud Storage and the external SIEM.

Professional Cloud Architect

Centralized Audit Log Export Retention Residency

Related questions