A financial services organization must implement a centralized log export architecture across all Google Cloud resources to comply with strict regulatory frameworks. The compliance and security requirements are: Comprehensive Audit Coverage: All audit logs from existing and future folders and projects across the organization must be captured automatically. Data Residency: Log archives must strictly reside in a designated geographic region (europe-west3). Tamper Resistance & Least Privilege: The log delivery mechanism must be restricted to write-only permissions on the destination archive to prevent exfiltration, modification, or deletion, while project administrators in child projects must have no access to alter or delete centralized logs. Which log export and IAM configuration should the security team implement?

Create an aggregated sink at the organization level with `--include-children` enabled, targeting a Cloud Storage bucket located in `europe-west3` within a dedicated security project. Grant the sink's generated writer identity only the `roles/storage.objectCreator` role on the destination bucket.: ### What this solution is This solution uses a Google Cloud **aggregated log sink** at the organization level combined with **least-privilege IAM permissions** and regional Cloud Storage configuration to deliver a centralized, secure, and compliant log repository. ### How it meets the requirements - **Comprehensive audit coverage**: Creating an aggregated sink at the organization root with the `--include-children` flag guarantees that all current and future child folders and projects automatically export their audit logs without requiring manual sink deployment per project. - **Data residency**: Setting the Cloud Storage bucket location specifically to `europe-west3` in a dedicated logging project guarantees that log archives remain stored within the mandated regulatory boundaries. - **Tamper resistance and least privilege**: Cloud Logging generates a dedicated **writer identity** (a service account) for the sink. Granting this identity only `roles/storage.objectCreator` ensures write-only access—the writer identity can upload (`storage.objects.create`) new log objects but cannot read, overwrite, or delete existing log entries. Furthermore, centralizing storage in a restricted security project isolates logs from child project administrators. ### Key advantages and capabilities - **Write-only permissions**: The `roles/storage.objectCreator` role prevents log exfiltration (no read permissions) and log tampering (no overwrite or delete permissions). - **Centralized governance**: Eliminates blind spots caused by unmonitored child projects or rogue project creation. - **Separation of duties**: Isolates log archives in a segregated security project managed exclusively by security/compliance teams. - **Immutability support**: Can be coupled with Cloud Storage Bucket Lock (Retention Policy) for WORM (Write Once, Read Many) compliance. ### Why this is optimal This architecture satisfies all compliance and isolation requirements by leveraging native GCP aggregated log sinks and atomic IAM role assignments, eliminating administrative overhead while enforcing strict data residency and write-only integrity.

Aggregated Log Sink Tamper Proof Architecture | Professional Cloud Security Engineer

Aggregated Log Sink Tamper Proof Architecture

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial services organization must implement a centralized log export architecture across all Google Cloud resources to comply with strict regulatory frameworks. The compliance and security requirements are:

Comprehensive Audit Coverage: All audit logs from existing and future folders and projects across the organization must be captured automatically.
Data Residency: Log archives must strictly reside in a designated geographic region (europe-west3).
Tamper Resistance & Least Privilege: The log delivery mechanism must be restricted to write-only permissions on the destination archive to prevent exfiltration, modification, or deletion, while project administrators in child projects must have no access to alter or delete centralized logs.

Which log export and IAM configuration should the security team implement?

Create an aggregated sink at the organization level with --include-children enabled, targeting a multi-region Cloud Storage bucket in a dedicated security project. Grant the sink's generated writer identity the roles/storage.objectAdmin role on the bucket.

Create an aggregated sink at the organization level with --include-children disabled, targeting a BigQuery dataset in europe-west3. Grant the sink's generated writer identity the roles/bigquery.admin role on the destination dataset.

Create an aggregated sink at the organization level with --include-children enabled, targeting a Cloud Storage bucket located in europe-west3 within a dedicated security project. Grant the sink's generated writer identity only the roles/storage.objectCreator role on the destination bucket.

Deploy individual project-level sinks in every project targeting a regional Cloud Storage bucket in europe-west3. Grant each project's default Compute Engine service account the roles/storage.objectCreator role on the bucket.

Professional Cloud Security Engineer

Aggregated Log Sink Tamper Proof Architecture

Related questions