An enterprise organization is establishing a centralized logging strategy across its Google Cloud resource hierarchy. The DevOps and security engineering teams have established three specific requirements for handling incoming audit logs: Requirement 1: Store logs for 7 years to meet strict regulatory compliance mandates at the lowest possible storage cost. Requirement 2: Perform multi-dimensional, ad-hoc SQL queries to correlate log activity with existing enterprise business data. Requirement 3: Stream log events in near real-time to an external Security Information and Event Management (SIEM) tool (such as Splunk or Datadog) for immediate automated alerting. Which log routing architecture should the DevOps engineer implement to satisfy all three requirements?

Configure Log Router sinks to send logs to a Cloud Storage bucket for regulatory compliance, a write-enabled BigQuery dataset for SQL analytics, and a Pub/Sub topic for streaming ingestion into the external SIEM.: ### What the Log Router Architecture Is **Cloud Logging Log Router** allows organizations to create sinks that direct incoming log streams to specific Google Cloud destinations. By leveraging destination-specific sinks, organizations can decouple log ingestion from downstream consumption patterns. ### How it meets the Requirements - **Requirement 1 (Low-cost compliance storage)**: Routing logs to a **Cloud Storage bucket** stores raw log entries as batched JSON files. This provides the most cost-effective solution for long-term retention when paired with **Object Lifecycle Management** or Archive storage classes. - **Requirement 2 (Multi-dimensional SQL analytics)**: Routing directly to a **write-enabled BigQuery dataset** allows Cloud Logging to stream structured records into managed tables, enabling high-performance SQL querying, partitioning, and joins with external business data. - **Requirement 3 (Real-time SIEM streaming)**: Routing logs to a **Pub/Sub topic** decouples message generation and delivers low-latency, scalable streaming queues that third-party SIEM platforms (like Splunk, Datadog, or Chronicle) pull or subscribe to via push subscriptions. ### Key advantages - **Native parallel routing**: A single log entry can be evaluated by multiple independent sinks and delivered simultaneously to different endpoints. - **Optimized cost per tier**: Archival data stays in low-cost object storage while high-performance analytics are isolated in BigQuery. - **Decoupled integration**: Pub/Sub provides durable buffering so external SIEM outages do not cause log loss. - **No intermediate compute overhead**: Eliminates the operational maintenance and failure points of self-managed transfer jobs. ### Why this is optimal Using native **Cloud Logging sinks** directly targeting **Cloud Storage**, **BigQuery**, and **Pub/Sub** aligns each workload pattern with the purpose-built storage engine designed specifically for its retention, query performance, and latency profile.

Evaluating Destination Specific Log Architectures Gcp | Professional Cloud DevOps Engineer

Evaluating Destination Specific Log Architectures Gcp

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization is establishing a centralized logging strategy across its Google Cloud resource hierarchy. The DevOps and security engineering teams have established three specific requirements for handling incoming audit logs:

Requirement 1: Store logs for 7 years to meet strict regulatory compliance mandates at the lowest possible storage cost.
Requirement 2: Perform multi-dimensional, ad-hoc SQL queries to correlate log activity with existing enterprise business data.
Requirement 3: Stream log events in near real-time to an external Security Information and Event Management (SIEM) tool (such as Splunk or Datadog) for immediate automated alerting.

Which log routing architecture should the DevOps engineer implement to satisfy all three requirements?

Configure a Log Router sink to route all logs exclusively to a Pub/Sub topic, subscribe a custom Dataflow streaming pipeline to fan out and write raw records to BigQuery and Cloud Storage.

Configure a single Log Router sink targeting a read-only linked BigQuery dataset, export batched query results to Pub/Sub, and schedule weekly transfer jobs to Cloud Storage.

Configure a Log Router sink to route logs exclusively to a Cloud Storage bucket, configure Object Finalize notifications to Pub/Sub for the SIEM, and load daily JSON files into BigQuery via batch jobs.

Configure Log Router sinks to send logs to a Cloud Storage bucket for regulatory compliance, a write-enabled BigQuery dataset for SQL analytics, and a Pub/Sub topic for streaming ingestion into the external SIEM.

Professional Cloud DevOps Engineer

Evaluating Destination Specific Log Architectures Gcp

Related questions