A multinational financial enterprise requires a centralized, tamper-proof security logging architecture across its entire Google Cloud organization to satisfy strict regulatory compliance requirements. The security engineering team defines the following mandatory requirements: Centrally aggregate all Admin Activity and Data Access audit logs from all current and future projects into a dedicated central security project. Encrypt all stored audit logs using a Customer-Managed Encryption Key (CMEK) and retain them for 7 years. Prevent any user, including organization administrators and project owners, from deleting log entries or shortening the retention period before expiration. Permit compliance audit personnel to view administrative actions across projects while strictly restricting them from viewing sensitive data access log payloads. Which combination of actions should the security engineer implement?

Create an organization-level aggregated sink with children inclusion routing to a CMEK-encrypted user-defined log bucket in the security project, lock the log bucket, create a custom log view filtering out Data Access logs, and grant the auditors roles/logging.viewAccessor on that view.: ### What the solution is This architecture establishes an organization-wide centralized logging pipeline that aggregates audit events, enforces data immutability, utilizes customer-controlled cryptography, and restricts access through granular log views. ### How it meets the requirements - **Organization-wide collection**: Creating an **aggregated log sink** at the organization root with the `--include-children` setting automatically routes audit logs from all existing and future child folders and projects into the centralized logging project. - **CMEK encryption & custom retention**: Provisioning a **user-defined log bucket** allows the configuration of Customer-Managed Encryption Keys (CMEK) via Cloud KMS and custom retention schedules (e.g., 7 years / 2,555 days). - **Tamper-proofing & immutability**: **Locking the log bucket** permanently prevents any IAM identity—including organization administrators and project owners—from deleting the bucket or reducing the retention duration while active records exist within their retention window. - **Granular least-privilege access**: Defining a custom **log view** that filters for `logName : "cloudaudit.googleapis.com%2Factivity"` and granting the `roles/logging.viewAccessor` IAM role allows compliance auditors to inspect administrative actions without accessing Data Access audit records. ### Key advantages - **Centralized governance**: Eliminates decentralized log sprawl and standardizes audit controls across all organizational workloads. - **WORM compliance**: Guarantees write-once-read-many (WORM) audit integrity against accidental or malicious administrative deletion. - **Auditing segregation**: Decouples read access permissions so general compliance reviewers do not inherit broad access to sensitive data access records. - **Cryptographic control**: Grants security teams instant data revocation capabilities by managing KMS key rings independently of the source project teams. ### Why this is optimal Native Cloud Logging features—specifically aggregated sinks, user-defined locked log buckets, and bucket log views—provide native end-to-end immutability, granular access scoping, and centralized query capabilities through Logs Explorer and Log Analytics without introducing third-party operational dependencies.

Configure Centralized Tamper Proof Security Logging | Professional Cloud Security Engineer

Configure Centralized Tamper Proof Security Logging

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A multinational financial enterprise requires a centralized, tamper-proof security logging architecture across its entire Google Cloud organization to satisfy strict regulatory compliance requirements.

The security engineering team defines the following mandatory requirements:

Centrally aggregate all Admin Activity and Data Access audit logs from all current and future projects into a dedicated central security project.
Encrypt all stored audit logs using a Customer-Managed Encryption Key (CMEK) and retain them for 7 years.
Prevent any user, including organization administrators and project owners, from deleting log entries or shortening the retention period before expiration.
Permit compliance audit personnel to view administrative actions across projects while strictly restricting them from viewing sensitive data access log payloads.

Which combination of actions should the security engineer implement?

Create an organization-level aggregated sink routing to a Cloud Storage bucket with Object Lock enabled, configure CMEK on the bucket, and grant the auditors the Storage Object Viewer role.

Create an organization-level aggregated sink with children inclusion routing to a CMEK-encrypted user-defined log bucket in the security project, lock the log bucket, create a custom log view filtering out Data Access logs, and grant the auditors roles/logging.viewAccessor on that view.

Create an organization-level aggregated sink routing to the _Required log bucket of the central security project, configure custom retention on the _Required bucket, and grant auditors the roles/logging.privateLogViewer role.

Create project-level sinks in every project routing to the _Default log bucket in the central security project, configure customer-managed encryption keys on the _Default bucket, and grant auditors the roles/logging.viewer role on the central project.

Professional Cloud Security Engineer

Configure Centralized Tamper Proof Security Logging

Related questions