Your enterprise organization consists of hundreds of Google Cloud projects organized across multiple folders. To comply with strict security standards, you must centralize all Data Access audit logs generated across the organization into a dedicated project named sec-central-logging. Your design must satisfy the following criteria: Data Access audit logs must automatically be collected from all current and future child folders and projects. Data Access audit logs must not be duplicated or stored in individual child projects' _Default log buckets, preventing unauthorized local access and unnecessary storage costs. System-critical logs handled by each project's _Required sink must continue to be routed normally to their local _Required log bucket. How should you configure the log routing architecture?

Create an intercepting aggregated log sink at the organization level targeting the project `sec-central-logging`, set `--include-children` and `--intercept-children`, and specify an inclusion filter for Data Access audit logs.: ### What an intercepting aggregated sink is An **intercepting aggregated log sink** is an organization- or folder-level log router sink configured with both `--include-children` and `--intercept-children`. It collates log entries from all descendant folders and projects while altering the normal hierarchical log flow. ### How it meets the requirements - **Automatic collection across hierarchy:** Applying the sink at the organization level with `--include-children` ensures that log entries from all existing and future child projects and folders are captured. - **Prevents project-level duplication and storage:** When a log entry matches an intercepting sink's filter, it is routed to the destination and **intercepted**, which stops the log entry from being evaluated or stored by project-level sinks (such as `_Default`) lower in the hierarchy. - **Preserves `_Required` sink routing:** The Log Router architecture guarantees that even when an intercepting aggregated sink matches a log entry, the entry is still delivered to the project-level `_Required` sink in the originating resource. - **Destination requirement:** Intercepting aggregated sinks require their destination to be a **Google Cloud project** (e.g., `logging.googleapis.com/projects/sec-central-logging`), where destination-level sinks can then manage final storage. ### Key advantages and capabilities - **Centralized security control:** Prevents sensitive audit logs from lingering in decentralized development environments. - **Cost efficiency:** Eliminates duplicate log ingestion charges and multi-bucket retention costs across projects. - **Automatic onboarding:** Dynamically applies to newly created projects without requiring local pipeline configuration. - **Built-in safety:** Ensures compliance by never dropping system-critical `_Required` audit entries. ### Why this is optimal This approach natively enforces hierarchical log containment using Cloud Logging Log Routers, fulfilling all security and cost boundaries without manual sink management in individual projects.

Configure Intercepting Aggregated Log Sink Central Logging | Professional Cloud DevOps Engineer

Configure Intercepting Aggregated Log Sink Central Logging

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise organization consists of hundreds of Google Cloud projects organized across multiple folders. To comply with strict security standards, you must centralize all Data Access audit logs generated across the organization into a dedicated project named sec-central-logging.

Your design must satisfy the following criteria:

Data Access audit logs must automatically be collected from all current and future child folders and projects.
Data Access audit logs must not be duplicated or stored in individual child projects' _Default log buckets, preventing unauthorized local access and unnecessary storage costs.
System-critical logs handled by each project's _Required sink must continue to be routed normally to their local _Required log bucket.

How should you configure the log routing architecture?

Create an intercepting aggregated log sink at the organization level targeting the project sec-central-logging, set --include-children and --intercept-children, and specify an inclusion filter for Data Access audit logs.

Create a non-intercepting aggregated log sink at the organization level targeting a Cloud Logging bucket in sec-central-logging, set --include-children, and specify an inclusion filter for Data Access audit logs.

Create an intercepting aggregated log sink at the organization level targeting a dedicated Cloud Logging bucket directly, set --include-children and --intercept-children, and specify an inclusion filter for Data Access audit logs.

Configure organization-level default resource settings to disable the _Default sink across all projects, and use a script to deploy individual project-level sinks routing Data Access audit logs to sec-central-logging.

Professional Cloud DevOps Engineer

Configure Intercepting Aggregated Log Sink Central Logging

Related questions