A security engineer is designing an enterprise-wide audit logging architecture across a Google Cloud Organization. The design must satisfy the following technical and operational requirements: Near real-time streaming of organizational audit logs to an external third-party SIEM. Centralized SQL analysis joining audit logs with enterprise data in BigQuery without destination write errors. Log volume and cost optimization within child projects without impacting mandatory Admin Activity audit logs. Which logging architecture should the engineer implement?

Create an organization-level aggregated sink routing audit logs to a Pub/Sub topic for SIEM ingestion; create an organization-level aggregated sink routing audit logs to a standard, write-enabled BigQuery dataset; and configure exclusion filters on the _Default sinks in projects to exclude high-volume Data Access logs.: ### What the solution is This solution implements an enterprise-grade log routing architecture using Google Cloud **aggregated sinks**, supported export destinations (**Pub/Sub** and **BigQuery**), and **Log Router exclusions** to capture critical audit telemetry while controlling storage and ingestion costs. ### How it meets all requirements - **Near real-time SIEM ingestion**: By creating an **aggregated sink** at the organization level with a destination set to a **Pub/Sub topic**, log entries across all folders and projects are collated and published as JSON messages in real time for external SIEM integration (such as Splunk or Datadog). - **Centralized SQL analytics without write errors**: The sink for SQL analysis targets a standard, **write-enabled BigQuery dataset**. Cloud Logging can stream structured `LogEntry` records directly into standard BigQuery datasets for complex joins with enterprise data. - **Cost and volume management**: Configuring **exclusion filters** on the `_Default` sinks prevents high-volume Data Access logs from being ingested into local project `_Default` log buckets, eliminating unnecessary ingestion charges. Furthermore, mandatory **Admin Activity** logs are automatically routed and retained in the `_Required` bucket and cannot be dropped or excluded. ### Key advantages and capabilities - **Centralized governance**: Organization-level aggregated sinks eliminate the operational burden of configuring individual sinks in every project. - **Decoupled consumption**: Pub/Sub provides scalable, decoupled buffering for external log consumers and SIEM connectors. - **Guaranteed audit integrity**: Core administrative actions remain permanently captured in the immutable `_Required` bucket regardless of custom exclusion rules. - **Cost predictability**: Filtering voluminous Data Access logs at the `_Default` sink level prevents runaway storage and ingestion costs. ### Why this is optimal This architecture directly addresses the unique capabilities and constraints of Cloud Logging routing destinations. It uses Pub/Sub for real-time third-party streaming, avoids read-only BigQuery destination failures, and leverages built-in exclusion mechanisms to balance compliance visibility with cost governance.

Configure Audit Log Sinks And Destinations | Professional Cloud Security Engineer

Configure Audit Log Sinks And Destinations

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is designing an enterprise-wide audit logging architecture across a Google Cloud Organization. The design must satisfy the following technical and operational requirements:

Near real-time streaming of organizational audit logs to an external third-party SIEM.
Centralized SQL analysis joining audit logs with enterprise data in BigQuery without destination write errors.
Log volume and cost optimization within child projects without impacting mandatory Admin Activity audit logs.

Which logging architecture should the engineer implement?

Create an organization-level aggregated sink routing audit logs to a Pub/Sub topic for SIEM ingestion; create an organization-level aggregated sink routing audit logs to a standard BigQuery dataset; and disable the _Required log sink in child projects to reduce log ingestion costs.

Create project-level sinks routing audit logs to Cloud Storage buckets for near real-time SIEM export; create an aggregated sink routing to a write-enabled BigQuery dataset; and modify the _Required sink to exclude Data Access audit logs.

Create an organization-level aggregated sink routing audit logs to a Pub/Sub topic for SIEM ingestion; create an organization-level aggregated sink routing audit logs to a standard, write-enabled BigQuery dataset; and configure exclusion filters on the _Default sinks in projects to exclude high-volume Data Access logs.

Create an organization-level aggregated sink routing audit logs to a Pub/Sub topic for SIEM ingestion; create an organization-level aggregated sink routing audit logs to a linked BigQuery dataset; and add exclusion filters on the _Default sinks to drop high-volume Data Access logs.

Professional Cloud Security Engineer

Configure Audit Log Sinks And Destinations

Related questions