A financial enterprise is designing a centralized logging and compliance architecture across all Google Cloud projects in its organization. The compliance and security teams have established the following requirements: All Admin Activity and Data Access audit logs must be retained for 5 years (1,825 days) to meet regulatory retention mandates. Audit logs must be protected against tampering, early deletion, and unauthorized modification using write-once-read-many (WORM) immutability. Log storage costs must be optimized by automatically transitioning older log data to Coldline storage after 90 days. Security auditors must have read-only access to view the archived log objects without being able to modify access policies or delete data. Which logging and storage strategy should the enterprise implement to satisfy these requirements?

Create an organization-level aggregated logging sink to route all audit logs to a centralized Cloud Storage bucket, configure Uniform Bucket-Level Access, apply an Object Lifecycle Management rule with the SetStorageClass action targeting Coldline after 90 days, enable a locked retention policy using Bucket Lock for 1,825 days, and grant auditors the Storage Object Viewer (roles/storage.objectViewer) IAM role.: ### What this solution is This solution implements an enterprise-grade log retention, archival, and access control architecture by combining **aggregated Cloud Logging sinks**, **Cloud Storage Object Lifecycle Management**, **Cloud Storage Bucket Lock**, and **granular Identity and Access Management (IAM)** roles. ### How it meets the requirements - **5-Year Regulatory Retention and WORM Protection**: Cloud Storage **Bucket Lock** allows organizations to define an immutable retention policy (1,825 days / 5 years). Once locked, the retention policy cannot be shortened or deleted by any identity, including Project Owners and Google Cloud administrators, ensuring strict Write-Once-Read-Many (WORM) compliance. - **Cost-Effective Archival**: Cloud Storage **Object Lifecycle Management** with the `SetStorageClass` action automatically inspects object age conditions and transitions data from Standard storage to **Coldline** storage after 90 days, significantly reducing long-term storage expenditures for infrequently accessed audit records. - **Least Privilege Access Controls**: Enabling **Uniform Bucket-Level Access (UBLA)** unifies permissions under IAM and disables object ACLs. Granting `roles/storage.objectViewer` gives auditors read-only access to inspect log objects while strictly withholding write, delete, and policy modification privileges (`storage.buckets.setIamPolicy`). - **Centralized Organization Coverage**: An organization-level aggregated sink captures both Admin Activity and Data Access audit logs across all existing and future child folders and projects. ### Key advantages - **Tamper-Proof Immutability**: Guarantees compliance with strict financial industry regulations (e.g., SEC Rule 17a-4, FINRA, HIPAA). - **Automated Cost Optimization**: Eliminates manual intervention to migrate multi-terabyte log archives across storage tiers. - **Centralized IAM Governance**: Uniform Bucket-Level Access prevents permission fragmentation caused by object-level ACLs. - **Separation of Duties**: Separates logging infrastructure administrators from compliance auditors. ### Why this is optimal Using Cloud Storage with Bucket Lock and Object Lifecycle Management provides a fully managed, compliant, and cost-effective long-term archival solution that exceeds the operational capabilities of standard log buckets while strictly enforcing least privilege.

Cloud Logging Audit Retention Archival Access Controls | Professional Cloud Security Engineer

Cloud Logging Audit Retention Archival Access Controls

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise is designing a centralized logging and compliance architecture across all Google Cloud projects in its organization. The compliance and security teams have established the following requirements:

All Admin Activity and Data Access audit logs must be retained for 5 years (1,825 days) to meet regulatory retention mandates.
Audit logs must be protected against tampering, early deletion, and unauthorized modification using write-once-read-many (WORM) immutability.
Log storage costs must be optimized by automatically transitioning older log data to Coldline storage after 90 days.
Security auditors must have read-only access to view the archived log objects without being able to modify access policies or delete data.

Which logging and storage strategy should the enterprise implement to satisfy these requirements?

Create an export sink routing logs to a Cloud Pub/Sub topic, subscribe a Compute Engine VM that writes logs to persistent disks, run a nightly cron job using gsutil to compress and upload files to Coldline storage, and apply iptables firewall rules to restrict VM access.

Create a Cloud Logging export sink to route audit logs to a BigQuery dataset, configure table partition expiration to 1,825 days, apply column-level access control on the dataset, and configure scheduled table snapshots to move partitioned tables into Coldline storage.

Configure a custom retention period of 1,825 days directly on the organization's _Default and _Required Cloud Logging buckets, configure field-level access controls to restrict deletion permissions, and rely on automatic Cloud Logging tiering to migrate older logs to Coldline storage.

Create an organization-level aggregated logging sink to route all audit logs to a centralized Cloud Storage bucket, configure Uniform Bucket-Level Access, apply an Object Lifecycle Management rule with the SetStorageClass action targeting Coldline after 90 days, enable a locked retention policy using Bucket Lock for 1,825 days, and grant auditors the Storage Object Viewer (roles/storage.objectViewer) IAM role.

Professional Cloud Security Engineer

Cloud Logging Audit Retention Archival Access Controls

Related questions