A multinational financial services company operates multiple Google Cloud projects across several business units organized under a single Google Cloud organization. To meet strict regulatory mandates and ensure auditability, the security and compliance team has established the following architecture requirements: All Cloud Audit Logs across all existing and future projects must be collected centrally. Audit logs must be retained for seven years in a cost-effective, tamper-resistant storage format for forensic analysis. The log data at rest must strictly reside within a specific geographic region (europe-west3) to comply with national data residency regulations. Real-time copies of high-severity security audit events must be forwarded immediately to an external, on-premises Security Information and Event Management (SIEM) system. Which logging architecture should you design to fulfill these requirements?

Create an organization-level aggregated log sink that routes all audit logs to a regional Cloud Storage bucket located in `europe-west3`, and configure a second aggregated log sink that filters high-severity security events to a Pub/Sub topic to stream logs to the external SIEM.: What this solution is This architecture uses organization-level aggregated log sinks in Cloud Logging to automatically capture audit logs from all current and future child projects. It routes long-term audit records to a regionally bound Cloud Storage bucket while routing real-time security events to a Pub/Sub topic for external SIEM streaming. How it meets the requirements Centralized Collection Across Projects: An organization-level aggregated sink automatically captures logs originating from all folders and projects within the organization hierarchy without requiring per-project sink maintenance. Data Residency Compliance: Configuring the destination Cloud Storage bucket explicitly in the europe-west3 region guarantees that data at rest stays within the specified geographic boundary. Cost-Effective Long-Term Retention: Cloud Storage provides low-cost, durable JSON object storage suitable for multi-year regulatory retention and post-incident forensic retrieval. Real-Time SIEM Integration: A separate sink routing filtered high-severity events to Pub/Sub enables asynchronous, low-latency streaming to third-party or on-premises SIEM platforms. Key advantages Scalable Governance: Automatically captures logs from newly created projects within the organization. Storage Optimization: Allows configuring Object Lifecycle Management and Bucket Lock (retention policies) on Cloud Storage for compliance. Decoupled Delivery: Pub/Sub provides a robust buffer for external integration without impacting log storage in Google Cloud.

StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Centralized Audit Log Export Retention Residency

Section: Audits (including logs)

A multinational financial services company operates multiple Google Cloud projects across several business units organized under a single Google Cloud organization. To meet strict regulatory mandates and ensure auditability, the security and compliance team has established the following architecture requirements:

All Cloud Audit Logs across all existing and future projects must be collected centrally.
Audit logs must be retained for seven years in a cost-effective, tamper-resistant storage format for forensic analysis.
The log data at rest must strictly reside within a specific geographic region (europe-west3) to comply with national data residency regulations.
Real-time copies of high-severity security audit events must be forwarded immediately to an external, on-premises Security Information and Event Management (SIEM) system.

Which logging architecture should you design to fulfill these requirements?

Configure the default _Required log bucket in each project to retain logs for seven years, and run a scheduled Cloud Run job that queries the Logs API hourly to push events to Cloud Storage and the external SIEM.

Configure project-level log sinks in each project routing audit logs to a linked BigQuery dataset located in europe-west3, and export daily snapshots to Cloud Storage using BigQuery Data Transfer Service.

Create an organization-level aggregated log sink that routes all audit logs to a regional Cloud Storage bucket located in europe-west3, and configure a second aggregated log sink that filters high-severity security events to a Pub/Sub topic to stream logs to the external SIEM.

Create an organization-level aggregated log sink directing audit logs to a multi-region BigQuery dataset in Europe, and configure Eventarc triggers to batch export audit logs to the external SIEM.

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Centralized Audit Log Export Retention Residency

Section: Audits (including logs)

All Cloud Audit Logs across all existing and future projects must be collected centrally.
Audit logs must be retained for seven years in a cost-effective, tamper-resistant storage format for forensic analysis.
The log data at rest must strictly reside within a specific geographic region (europe-west3) to comply with national data residency regulations.
Real-time copies of high-severity security audit events must be forwarded immediately to an external, on-premises Security Information and Event Management (SIEM) system.

Which logging architecture should you design to fulfill these requirements?

Create an organization-level aggregated log sink directing audit logs to a multi-region BigQuery dataset in Europe, and configure Eventarc triggers to batch export audit logs to the external SIEM.

Explanations

What this solution is

This architecture uses organization-level aggregated log sinks in Cloud Logging to automatically capture audit logs from all current and future child projects. It routes long-term audit records to a regionally bound Cloud Storage bucket while routing real-time security events to a Pub/Sub topic for external SIEM streaming.

How it meets the requirements

Centralized Collection Across Projects: An organization-level aggregated sink automatically captures logs originating from all folders and projects within the organization hierarchy without requiring per-project sink maintenance.
Data Residency Compliance: Configuring the destination Cloud Storage bucket explicitly in the europe-west3 region guarantees that data at rest stays within the specified geographic boundary.
Cost-Effective Long-Term Retention: Cloud Storage provides low-cost, durable JSON object storage suitable for multi-year regulatory retention and post-incident forensic retrieval.
Real-Time SIEM Integration: A separate sink routing filtered high-severity events to Pub/Sub enables asynchronous, low-latency streaming to third-party or on-premises SIEM platforms.

Key advantages

Scalable Governance: Automatically captures logs from newly created projects within the organization.
Storage Optimization: Allows configuring Object Lifecycle Management and Bucket Lock (retention policies) on Cloud Storage for compliance.
Decoupled Delivery: Pub/Sub provides a robust buffer for external integration without impacting log storage in Google Cloud.

View source documentation

Professional Cloud Architect

Centralized Audit Log Export Retention Residency

Professional Cloud Architect

Centralized Audit Log Export Retention Residency

What this solution is

How it meets the requirements

Key advantages

Related questions