Cloud Logging Field Level Access Control Pii 2 | Professional Cloud DevOps Engineer | StudyCerts

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Logging Field Level Access Control Pii 2

Section: Handling sensitive data (e.g., using log processors to redact personally identifiable information [PII], protected health information [PHI])

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An organization is running containerized microservices where application logs occasionally contain sensitive user data, such as jsonPayload.user_email and jsonPayload.tax_id.

DevOps engineers require continuous access to these logs in Logs Explorer to debug production incidents, inspect error codes, and verify request latency. However, security compliance requires that standard engineers cannot view the sensitive PII fields, while authorized compliance auditors must retain the ability to inspect the full, unredacted log entries.

Which native Cloud Logging strategy should you implement to meet these requirements?

Define an exclusion filter on the _Default log sink matching jsonPayload.user_email:* OR jsonPayload.tax_id:* so that sensitive fields are stripped before ingestion.

Configure field-level access controls on the log bucket by setting the restricted fields list, and grant the roles/logging.fieldAccessor IAM role exclusively to the compliance auditors.

Create two separate Log Views on the log bucket, applying a filter on the engineers' Log View to hide log entries containing jsonPayload.user_email and jsonPayload.tax_id.

Enable Log Analytics on the bucket, configure field-level access controls, and use SQL views to mask the sensitive JSON payload keys.

Professional Cloud DevOps Engineer

Cloud Logging Field Level Access Control Pii 2

Related questions