Your enterprise organization consists of hundreds of Google Cloud projects organized across multiple folders. To comply with strict security standards, you must centralize all Data Access audit logs generated across the organization into a dedicated project named sec-central-logging. Your design must satisfy the following criteria: Data Access audit logs must automatically be collected from all current and future child folders and projects. Data Access audit logs must not be duplicated or stored in individual child projects' _Default log buckets, preventing unauthorized local access and unnecessary storage costs. System-critical logs handled by each project's _Required sink must continue to be routed normally to their local _Required log bucket. How should you configure the log routing architecture?

Create an intercepting aggregated log sink at the organization level targeting the project `sec-central-logging`, set `--include-children` and `--intercept-children`, and specify an inclusion filter for Data Access audit logs.: What an intercepting aggregated sink is An intercepting aggregated log sink is an organization- or folder-level log router sink configured with both --include-children and --intercept-children. It collates log entries from all descendant folders and projects while altering the normal hierarchical log flow. How it meets the requirements Automatic collection across hierarchy: Applying the sink at the organization level with --include-children ensures that log entries from all existing and future child projects and folders are captured. Prevents project-level duplication and storage: When a log entry matches an intercepting sink's filter, it is routed to the destination and intercepted, which stops the log entry from being evaluated or stored by project-level sinks (such as _Default) lower in the hierarchy. Preserves _Required sink routing: The Log Router architecture guarantees that even when an intercepting aggregated sink matches a log entry, the entry is still delivered to the project-level _Required sink in the originating resource. Destination requirement: Intercepting aggregated sinks require their destination to be a Google Cloud project (e.g., logging.googleapis.com/projects/sec-central-logging), where destination-level sinks can then manage final storage. Key advantages and capabilities Centralized security control: Prevents sensitive audit logs from lingering in decentralized development environments. Cost efficiency: Eliminates duplicate log ingestion charges and multi-bucket retention costs across projects. Automatic onboarding: Dynamically applies to newly created projects without requiring local pipeline configuration. Built-in safety: Ensures compliance by never dropping system-critical _Required audit entries. Why this is optimal This approach natively enforces hierarchical log containment using Cloud Logging Log Routers, fulfilling all security and cost boundaries without manual sink management in individual projects.

StudyCerts

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Configure Intercepting Aggregated Log Sink Central Logging

Section: Exporting and retaining logs (e.g., routing to BigQuery, Pub/Sub, Cloud Storage)

Your enterprise organization consists of hundreds of Google Cloud projects organized across multiple folders. To comply with strict security standards, you must centralize all Data Access audit logs generated across the organization into a dedicated project named sec-central-logging.

Your design must satisfy the following criteria:

Data Access audit logs must automatically be collected from all current and future child folders and projects.
Data Access audit logs must not be duplicated or stored in individual child projects' _Default log buckets, preventing unauthorized local access and unnecessary storage costs.
System-critical logs handled by each project's _Required sink must continue to be routed normally to their local _Required log bucket.

How should you configure the log routing architecture?

Create a non-intercepting aggregated log sink at the organization level targeting a Cloud Logging bucket in sec-central-logging, set --include-children, and specify an inclusion filter for Data Access audit logs.

Create an intercepting aggregated log sink at the organization level targeting the project sec-central-logging, set --include-children and --intercept-children, and specify an inclusion filter for Data Access audit logs.

Create an intercepting aggregated log sink at the organization level targeting a dedicated Cloud Logging bucket directly, set --include-children and --intercept-children, and specify an inclusion filter for Data Access audit logs.

Configure organization-level default resource settings to disable the _Default sink across all projects, and use a script to deploy individual project-level sinks routing Data Access audit logs to sec-central-logging.

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Configure Intercepting Aggregated Log Sink Central Logging

Section: Exporting and retaining logs (e.g., routing to BigQuery, Pub/Sub, Cloud Storage)

Your design must satisfy the following criteria:

Data Access audit logs must automatically be collected from all current and future child folders and projects.
Data Access audit logs must not be duplicated or stored in individual child projects' _Default log buckets, preventing unauthorized local access and unnecessary storage costs.
System-critical logs handled by each project's _Required sink must continue to be routed normally to their local _Required log bucket.

How should you configure the log routing architecture?

Explanations

What an intercepting aggregated sink is

An intercepting aggregated log sink is an organization- or folder-level log router sink configured with both --include-children and --intercept-children. It collates log entries from all descendant folders and projects while altering the normal hierarchical log flow.

How it meets the requirements

Automatic collection across hierarchy: Applying the sink at the organization level with --include-children ensures that log entries from all existing and future child projects and folders are captured.
Prevents project-level duplication and storage: When a log entry matches an intercepting sink's filter, it is routed to the destination and intercepted, which stops the log entry from being evaluated or stored by project-level sinks (such as _Default) lower in the hierarchy.
Preserves _Required sink routing: The Log Router architecture guarantees that even when an intercepting aggregated sink matches a log entry, the entry is still delivered to the project-level _Required sink in the originating resource.
Destination requirement: Intercepting aggregated sinks require their destination to be a Google Cloud project (e.g., logging.googleapis.com/projects/sec-central-logging), where destination-level sinks can then manage final storage.

Key advantages and capabilities

Centralized security control: Prevents sensitive audit logs from lingering in decentralized development environments.
Cost efficiency: Eliminates duplicate log ingestion charges and multi-bucket retention costs across projects.
Automatic onboarding: Dynamically applies to newly created projects without requiring local pipeline configuration.
Built-in safety: Ensures compliance by never dropping system-critical _Required audit entries.

Why this is optimal

This approach natively enforces hierarchical log containment using Cloud Logging Log Routers, fulfilling all security and cost boundaries without manual sink management in individual projects.

View source documentation

Professional Cloud DevOps Engineer

Configure Intercepting Aggregated Log Sink Central Logging

Professional Cloud DevOps Engineer

Configure Intercepting Aggregated Log Sink Central Logging

What an intercepting aggregated sink is

How it meets the requirements

Key advantages and capabilities

Why this is optimal

Related questions

Eventarc Cloud Run Authentication