Your organization is designing an enterprise log export and retention pipeline in Google Cloud to meet strict financial regulatory standards. The pipeline architecture has the following compliance and operational requirements: Route all organization-wide audit logs to an immutable Cloud Storage destination where records cannot be modified or deleted by any user or administrator for seven years. Export application logs to BigQuery for real-time SQL analytics, optimizing query costs and enabling automated expiration of data older than 90 days. Follow the principle of least privilege when configuring access and authorization for the log export mechanisms. Which combination of actions should you implement?

Configure an aggregated Cloud Logging sink exporting to a Cloud Storage bucket with a 7-year retention policy locked using Bucket Lock, and a second sink exporting to a daily date-partitioned BigQuery table with partition expiration set to 90 days; grant the sink writer identities the Storage Object Creator role on the bucket and the BigQuery Data Editor role on the dataset.: ### What the solution is This solution implements a secure, compliance-ready log ingestion and archival pipeline across **Cloud Logging**, **Cloud Storage**, and **BigQuery**. It pairs automated log routing with immutable object retention and cost-optimized, time-partitioned analytical storage. ### How it meets the requirements - **Immutable Compliance Retention**: Applying a **Cloud Storage Retention Policy** and locking it with **Bucket Lock** enforces a WORM (Write Once, Read Many) state. Once locked, the policy cannot be deleted or shortened by any identity, ensuring audit logs remain untampered for the required 7 years. - **Cost-Optimized BigQuery Analytics and Expiration**: Routing logs to an ingestion-time or date-partitioned table allows SQL queries to prune partitions, significantly lowering scan costs. Configuring **partition expiration** at 90 days automatically purges older data at the partition level without recurring manual batch deletion jobs. - **Least Privilege Authorization**: Granting `roles/storage.objectCreator` allows the log sink's unique **writer identity** service account to write audit logs into the Cloud Storage bucket without granting permissions to read, overwrite, or delete existing objects. Similarly, granting `roles/bigquery.dataEditor` scoped strictly to the target BigQuery dataset enables seamless log streaming. ### Key advantages and capabilities - **WORM Compliance**: Protects log archives against insider threats and accidental deletion via locked retention periods. - **Partition Pruning**: Minimizes query processing costs by restricting BigQuery scans to relevant date ranges. - **Automated Lifecycle**: Handles data expiration automatically at the partition boundary without query overhead or maintenance scripts. - **Least Privilege**: Utilizes dedicated service account writer identities with granular create-only privileges. ### Why this is optimal Using Cloud Logging sinks paired with dedicated writer identities avoids credential sharing and follows Google Cloud recommended access control patterns. Storing analytical logs in partitioned BigQuery tables alongside locked Cloud Storage compliance archives balances low-cost long-term retention with high-performance real-time analytics.

Securing Log Export Pipeline Compliance Retention | Professional Cloud DevOps Engineer

Securing Log Export Pipeline Compliance Retention

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your organization is designing an enterprise log export and retention pipeline in Google Cloud to meet strict financial regulatory standards.

The pipeline architecture has the following compliance and operational requirements:

Route all organization-wide audit logs to an immutable Cloud Storage destination where records cannot be modified or deleted by any user or administrator for seven years.
Export application logs to BigQuery for real-time SQL analytics, optimizing query costs and enabling automated expiration of data older than 90 days.
Follow the principle of least privilege when configuring access and authorization for the log export mechanisms.

Which combination of actions should you implement?

Export audit logs to a Cloud Storage bucket configured with an unlocked retention policy, and stream analytical logs to a single non-partitioned BigQuery table with table-level long-term storage pricing; grant the sink writer identity the Owner role on the destination project.

Configure Cloud Logging to store audit logs in the system-created _Required log bucket with custom 7-year retention, and route analytical logs to Cloud SQL using a custom service account with the Cloud SQL Admin role.

Configure an aggregated Cloud Logging sink exporting to a Cloud Storage bucket with a 7-year retention policy locked using Bucket Lock, and a second sink exporting to a daily date-partitioned BigQuery table with partition expiration set to 90 days; grant the sink writer identities the Storage Object Creator role on the bucket and the BigQuery Data Editor role on the dataset.

Create an aggregated log sink exporting to a standard Cloud Storage bucket using Object Versioning, and export logs to BigQuery sharded tables; grant the default Compute Engine service account the Storage Admin and BigQuery Admin roles on the project.

Professional Cloud DevOps Engineer

Securing Log Export Pipeline Compliance Retention

Related questions