A security engineer is designing a centralized logging and compliance architecture across a multi-project Google Cloud organization. The architecture must satisfy the following technical and operational requirements: Aggregate all Admin Activity, System Event, VPC Flow Logs, and Data Access audit logs from all current and future projects into a centralized log bucket with a 365-day retention policy. Ensure all service account impersonation and short-lived credential generation events are captured. Minimize log ingestion overhead and processing load by preventing high-volume DATA_READ and DATA_WRITE audit logs from specific automated batch service accounts from being generated at the source in Cloud Bigtable. Prevent duplicate ingestion and storage costs across child projects' _Default log buckets. Which combination of actions should the security engineer implement?

1. Create an organization-level aggregated Log Router sink configured with children inclusion routing to a centralized log bucket set to a 365-day retention period. 2. In the organization IAM audit policy, enable Data Access audit logs across all services, ensure the IAM API and Security Token Service API are enabled, and configure audit configuration exemptions for the specific Bigtable service accounts. 3. Disable or add exclusion filters to the `_Default` log sinks in the child projects.: ### What this logging architecture is This architecture establishes an enterprise-wide, centralized log aggregation pipeline using **organization-level aggregated sinks**, granular **IAM Data Access audit policies**, and **Log Router exclusions** to capture critical security telemetry while optimizing costs and operational overhead. ### How it meets the requirements - **Organization-level aggregation and retention**: An aggregated log sink defined at the organization root with `--include-children` automatically collects log entries from all current and future child projects and folders. Routing these logs to a central log bucket with a custom retention period of **365 days** satisfies regulatory and auditing requirements. - **Capturing impersonation events**: Enabling Data Access audit logs for the **Identity and Access Management (IAM) API** and **Security Token Service API** ensures that token generation, role assumption, and service account impersonation events are recorded in the audit trail. - **Preventing log generation at the source**: Setting **audit configuration exemptions** within the IAM audit policy stops high-volume `DATA_READ` and `DATA_WRITE` logs from being generated by the underlying storage service in the first place, eliminating processing load and API quotas at the source. - **Preventing duplicate ingestion**: Disabling or placing exclusion filters on child project `_Default` sinks (or utilizing an intercepting aggregated sink) stops child projects from duplicating log storage in their local `_Default` buckets. ### Key advantages and capabilities - **Automatic inheritance**: Future projects under the organization hierarchy are immediately covered by the aggregated sink without manual intervention. - **Source-level throttling**: Exempting identities in the IAM audit config prevents excessive resource overhead compared to post-ingestion exclusion filters. - **Non-repudiation**: Centralizes log management in a dedicated security project where access permissions can be strictly restricted. ### Why this is optimal This approach avoids unnecessary log generation overhead at the source, eliminates duplicate billing, and guarantees end-to-end security visibility across authentication delegation and data access.

Centralized Audit Logging Pipeline Gcp | Professional Cloud Security Engineer

Centralized Audit Logging Pipeline Gcp

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is designing a centralized logging and compliance architecture across a multi-project Google Cloud organization. The architecture must satisfy the following technical and operational requirements:

Aggregate all Admin Activity, System Event, VPC Flow Logs, and Data Access audit logs from all current and future projects into a centralized log bucket with a 365-day retention policy.
Ensure all service account impersonation and short-lived credential generation events are captured.
Minimize log ingestion overhead and processing load by preventing high-volume DATA_READ and DATA_WRITE audit logs from specific automated batch service accounts from being generated at the source in Cloud Bigtable.
Prevent duplicate ingestion and storage costs across child projects' _Default log buckets.

Which combination of actions should the security engineer implement?

Create an organization-level aggregated Log Router sink configured with children inclusion routing to a centralized log bucket set to a 365-day retention period.
In the organization IAM audit policy, enable Data Access audit logs across all services, ensure the IAM API and Security Token Service API are enabled, and configure audit configuration exemptions for the specific Bigtable service accounts.
Disable or add exclusion filters to the _Default log sinks in the child projects.

Deploy an organization-level aggregated Log Router sink routing to BigQuery.
Enforce the compute.disableNestedVirtualization organization policy to generate VPC Flow Logs.
Configure field-level access control on the central log bucket to redact Bigtable service account records.
Disable the _Required log bucket across all projects to prevent duplicate audit logging.

Create an aggregated Log Router sink at the organization level routing to a central log bucket.
Rely on default Google Cloud audit logging settings to capture Admin Activity and Data Access logs.
Configure Cloud Functions triggered by Pub/Sub to delete Bigtable logs from the log bucket after ingestion.
Apply an Organization Policy constraint to block _Default bucket creation across child projects.

Create individual Log Router sinks in every individual project routing to a central Cloud Storage bucket with object lifecycle management set to 365 days.
In the project-level IAM policies, enable default Data Access audit logs for Bigtable and Compute Engine.
Configure Log Router exclusion filters on each project sink to filter out DATA_READ and DATA_WRITE log entries matching the automated service accounts.
Modify the system-created _Required log sink in each project to drop duplicate Admin Activity logs.

Professional Cloud Security Engineer

Centralized Audit Logging Pipeline Gcp

Related questions