An enterprise organization wants to centralize Data Access audit logs generated across all child projects within a folder named Production into a dedicated project named sec-ops-logging. The security team must satisfy the following architectural and operational requirements: All Data Access audit logs originating in existing and future child projects under the Production folder must automatically route to the central destination. To eliminate unnecessary storage costs and data duplication, matching Data Access audit logs must not be ingested or stored in the child projects' _Default log buckets. Mandatory Admin Activity logs must continue to flow to the _Required log bucket within each local originating project. Which sink configuration should the security engineer implement to achieve this goal?

Create an aggregated sink at the Production folder level with the --include-children and --intercept-children flags, targeting the sec-ops-logging project as the destination.: ### What an Intercepting Aggregated Sink Is An **intercepting aggregated sink** is a Cloud Logging configuration deployed at a parent folder or organization level that collates log entries from child resources while altering standard log routing inheritance. ### How It Meets the Requirements * **Hierarchical Log Collection (`--include-children`)**: Applying the sink at the `Production` folder level with `--include-children` guarantees that log entries from all existing and newly created descendant folders and projects are automatically evaluated and routed. * **Preventing Duplicate Storage (`--intercept-children`)**: When a log entry matches the filter of an **intercepting sink**, the Log Router halts downward propagation. The log entry is delivered to the designated central sink destination and is prevented from flowing down to child resource sinks—specifically bypassing project-level custom sinks and the child project's `_Default` sink. * **Preserving Mandatory Audit Logs**: Google Cloud Log Router guarantees that even when an intercepting sink captures and reroutes a log entry, the entry is still delivered to the system-defined `_Required` sink in the originating project. This ensures critical **Admin Activity** and system events remain locally accessible. * **Supported Destination Compatibility**: The destination for an intercepting aggregated sink must be a **Google Cloud project** (such as `sec-ops-logging`), where destination sinks can subsequently reroute entries into specific log buckets or BigQuery datasets. ### Key Advantages * **Cost Optimization**: Prevents double-ingestion fees by blocking unwanted copies from entering project-level `_Default` buckets. * **Centralized Governance**: Enforces organization-wide security monitoring without requiring manual sink management in individual child projects. * **Automatic Inheritance**: Automatically captures logs from new projects provisioned within the folder without administrative intervention.

Gcp Aggregated Intercepting Sink Folder Centralization | Professional Cloud Security Engineer

Gcp Aggregated Intercepting Sink Folder Centralization

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization wants to centralize Data Access audit logs generated across all child projects within a folder named Production into a dedicated project named sec-ops-logging. The security team must satisfy the following architectural and operational requirements:

All Data Access audit logs originating in existing and future child projects under the Production folder must automatically route to the central destination.
To eliminate unnecessary storage costs and data duplication, matching Data Access audit logs must not be ingested or stored in the child projects' _Default log buckets.
Mandatory Admin Activity logs must continue to flow to the _Required log bucket within each local originating project.

Which sink configuration should the security engineer implement to achieve this goal?

Create an intercepting aggregated sink at the Production folder level with the --include-children and --intercept-children flags, targeting a Cloud Storage bucket directly.

Configure individual project-level log sinks in each child project targeting sec-ops-logging, and disable the _Default sink in every child project.

Create an aggregated sink at the Production folder level with the --include-children and --intercept-children flags, targeting the sec-ops-logging project as the destination.

Create an aggregated sink at the Production folder level with the --include-children flag only, targeting the sec-ops-logging project as the destination.

Professional Cloud Security Engineer

Gcp Aggregated Intercepting Sink Folder Centralization

Related questions