A DevOps team manages multi-project CI/CD pipelines and infrastructure deployments across an enterprise Google Cloud organization. To meet strict regulatory compliance and security auditing standards, the team must implement a centralized deployment auditing strategy that satisfies the following requirements: Track all administrative resource modifications (such as modifications to deployment pipelines and cluster configurations) across all current and future projects. Capture read and write operations targeting sensitive deployment assets (such as Kubernetes Secrets accessed via the Kubernetes API server). Retain all audit data centrally for multi-year compliance analysis and allow security analysts to perform complex analytical SQL queries across the unified dataset. Which combination of Cloud Audit Logs configuration and log routing should the DevOps engineer implement?

Explicitly enable Data Access audit logs for required services in the organization audit configuration, and create an organization-level aggregated log sink filtering for Cloud Audit Logs routed to a centralized BigQuery dataset.: ### What the Solution Is This architecture combines Google Cloud's **Cloud Audit Logs** configuration with an **organization-level aggregated log sink** destined for **BigQuery**. ### How It Meets the Requirements - **Track administrative modifications across projects**: **Admin Activity audit logs** record configuration and metadata modifications (such as modifying cluster configurations or build pipelines). These logs are enabled by default across all projects and cannot be disabled. - **Capture read/write operations on sensitive deployment assets**: Operations reading or writing user-provided data (like inspecting or updating Kubernetes Secret resources via the `k8s.io` service) generate **Data Access audit logs**. Because Data Access audit logs are disabled by default (except for BigQuery), explicitly enabling them via the IAM audit policy at the organization or project level ensures these sensitive calls are recorded. - **Centralized retention and SQL analysis**: An **aggregated log sink** configured at the organization level collects log entries from all child folders and projects automatically. Routing these audit logs (`cloudaudit.googleapis.com%2Factivity` and `cloudaudit.googleapis.com%2Fdata_access`) to **BigQuery** allows security teams to retain logs long-term and execute high-performance analytical SQL queries across the enterprise dataset. ### Key Advantages and Capabilities - **Automated ingestion**: Future projects created under the organization automatically inherit the aggregated sink routing rules without manual sink provisioning. - **Granular audit coverage**: Enabling Data Access audit logs captures `ADMIN_READ`, `DATA_READ`, and `DATA_WRITE` events that standard logging ignores. - **SQL query power**: BigQuery provides scalable data warehousing capabilities to join deployment logs against infrastructure change records. - **Centralized governance**: Eliminates decentralized, per-project logging bucket configurations. ### Why This Is Optimal Aggregated sinks configured at the organization level eliminate operational overhead and security blind spots by capturing logs across all existing and new projects. Direct routing to BigQuery natively satisfies analytical SQL requirements without additional data transfer pipelines.

Cloud Audit Logs Aggregated Sink Bigquery | Professional Cloud DevOps Engineer

Cloud Audit Logs Aggregated Sink Bigquery

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A DevOps team manages multi-project CI/CD pipelines and infrastructure deployments across an enterprise Google Cloud organization. To meet strict regulatory compliance and security auditing standards, the team must implement a centralized deployment auditing strategy that satisfies the following requirements:

Track all administrative resource modifications (such as modifications to deployment pipelines and cluster configurations) across all current and future projects.
Capture read and write operations targeting sensitive deployment assets (such as Kubernetes Secrets accessed via the Kubernetes API server).
Retain all audit data centrally for multi-year compliance analysis and allow security analysts to perform complex analytical SQL queries across the unified dataset.

Which combination of Cloud Audit Logs configuration and log routing should the DevOps engineer implement?

Rely on default Cloud Logging configurations, grant security analysts the Logs Viewer role (roles/logging.viewer), and route logs to a Cloud Storage coldline bucket via Pub/Sub topics.

Create non-aggregated project log sinks that exclude Data Access logs, configure Cloud Monitoring log-based metrics for all deployments, and query the logs using the Cloud Billing console.

Explicitly enable Admin Activity audit logs in the organization IAM policy, and configure individual project-level log sinks routing System Event audit logs to Cloud Storage buckets.

Explicitly enable Data Access audit logs for required services in the organization audit configuration, and create an organization-level aggregated log sink filtering for Cloud Audit Logs routed to a centralized BigQuery dataset.

Professional Cloud DevOps Engineer

Cloud Audit Logs Aggregated Sink Bigquery

Related questions