Your organization is designing an enterprise log export and retention pipeline in Google Cloud to meet strict financial regulatory standards. The pipeline architecture has the following compliance and operational requirements: Route all organization-wide audit logs to an immutable Cloud Storage destination where records cannot be modified or deleted by any user or administrator for seven years. Export application logs to BigQuery for real-time SQL analytics, optimizing query costs and enabling automated expiration of data older than 90 days. Follow the principle of least privilege when configuring access and authorization for the log export mechanisms. Which combination of actions should you implement?

Configure an aggregated Cloud Logging sink exporting to a Cloud Storage bucket with a 7-year retention policy locked using Bucket Lock, and a second sink exporting to a daily date-partitioned BigQuery table with partition expiration set to 90 days; grant the sink writer identities the Storage Object Creator role on the bucket and the BigQuery Data Editor role on the dataset.: What the solution is This solution implements a secure, compliance-ready log ingestion and archival pipeline across Cloud Logging, Cloud Storage, and BigQuery. It pairs automated log routing with immutable object retention and cost-optimized, time-partitioned analytical storage. How it meets the requirements Immutable Compliance Retention: Applying a Cloud Storage Retention Policy and locking it with Bucket Lock enforces a WORM (Write Once, Read Many) state. Once locked, the policy cannot be deleted or shortened by any identity, ensuring audit logs remain untampered for the required 7 years. Cost-Optimized BigQuery Analytics and Expiration: Routing logs to an ingestion-time or date-partitioned table allows SQL queries to prune partitions, significantly lowering scan costs. Configuring partition expiration at 90 days automatically purges older data at the partition level without recurring manual batch deletion jobs. Least Privilege Authorization: Granting roles/storage.objectCreator allows the log sink's unique writer identity service account to write audit logs into the Cloud Storage bucket without granting permissions to read, overwrite, or delete existing objects. Similarly, granting roles/bigquery.dataEditor scoped strictly to the target BigQuery dataset enables seamless log streaming. Key advantages and capabilities WORM Compliance: Protects log archives against insider threats and accidental deletion via locked retention periods. Partition Pruning: Minimizes query processing costs by restricting BigQuery scans to relevant date ranges. Automated Lifecycle: Handles data expiration automatically at the partition boundary without query overhead or maintenance scripts. Least Privilege: Utilizes dedicated service account writer identities with granular create-only privileges. Why this is optimal Using Cloud Logging sinks paired with dedicated writer identities avoids credential sharing and follows Google Cloud recommended access control patterns. Storing analytical logs in partitioned BigQuery tables alongside locked Cloud Storage compliance archives balances low-cost long-term retention with high-performance real-time analytics.

StudyCerts

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Securing Log Export Pipeline Compliance Retention

Section: Exporting and retaining logs (e.g., routing to BigQuery, Pub/Sub, Cloud Storage)

Your organization is designing an enterprise log export and retention pipeline in Google Cloud to meet strict financial regulatory standards.

The pipeline architecture has the following compliance and operational requirements:

Route all organization-wide audit logs to an immutable Cloud Storage destination where records cannot be modified or deleted by any user or administrator for seven years.
Export application logs to BigQuery for real-time SQL analytics, optimizing query costs and enabling automated expiration of data older than 90 days.
Follow the principle of least privilege when configuring access and authorization for the log export mechanisms.

Which combination of actions should you implement?

Configure an aggregated Cloud Logging sink exporting to a Cloud Storage bucket with a 7-year retention policy locked using Bucket Lock, and a second sink exporting to a daily date-partitioned BigQuery table with partition expiration set to 90 days; grant the sink writer identities the Storage Object Creator role on the bucket and the BigQuery Data Editor role on the dataset.

Export audit logs to a Cloud Storage bucket configured with an unlocked retention policy, and stream analytical logs to a single non-partitioned BigQuery table with table-level long-term storage pricing; grant the sink writer identity the Owner role on the destination project.

Create an aggregated log sink exporting to a standard Cloud Storage bucket using Object Versioning, and export logs to BigQuery sharded tables; grant the default Compute Engine service account the Storage Admin and BigQuery Admin roles on the project.

Configure Cloud Logging to store audit logs in the system-created _Required log bucket with custom 7-year retention, and route analytical logs to Cloud SQL using a custom service account with the Cloud SQL Admin role.

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Securing Log Export Pipeline Compliance Retention

Section: Exporting and retaining logs (e.g., routing to BigQuery, Pub/Sub, Cloud Storage)

Your organization is designing an enterprise log export and retention pipeline in Google Cloud to meet strict financial regulatory standards.

The pipeline architecture has the following compliance and operational requirements:

Route all organization-wide audit logs to an immutable Cloud Storage destination where records cannot be modified or deleted by any user or administrator for seven years.
Export application logs to BigQuery for real-time SQL analytics, optimizing query costs and enabling automated expiration of data older than 90 days.
Follow the principle of least privilege when configuring access and authorization for the log export mechanisms.

Which combination of actions should you implement?

Explanations

What the solution is

This solution implements a secure, compliance-ready log ingestion and archival pipeline across Cloud Logging, Cloud Storage, and BigQuery. It pairs automated log routing with immutable object retention and cost-optimized, time-partitioned analytical storage.

How it meets the requirements

Immutable Compliance Retention: Applying a Cloud Storage Retention Policy and locking it with Bucket Lock enforces a WORM (Write Once, Read Many) state. Once locked, the policy cannot be deleted or shortened by any identity, ensuring audit logs remain untampered for the required 7 years.
Cost-Optimized BigQuery Analytics and Expiration: Routing logs to an ingestion-time or date-partitioned table allows SQL queries to prune partitions, significantly lowering scan costs. Configuring partition expiration at 90 days automatically purges older data at the partition level without recurring manual batch deletion jobs.
Least Privilege Authorization: Granting roles/storage.objectCreator allows the log sink's unique writer identity service account to write audit logs into the Cloud Storage bucket without granting permissions to read, overwrite, or delete existing objects. Similarly, granting roles/bigquery.dataEditor scoped strictly to the target BigQuery dataset enables seamless log streaming.

Key advantages and capabilities

WORM Compliance: Protects log archives against insider threats and accidental deletion via locked retention periods.
Partition Pruning: Minimizes query processing costs by restricting BigQuery scans to relevant date ranges.
Automated Lifecycle: Handles data expiration automatically at the partition boundary without query overhead or maintenance scripts.
Least Privilege: Utilizes dedicated service account writer identities with granular create-only privileges.

Why this is optimal

Using Cloud Logging sinks paired with dedicated writer identities avoids credential sharing and follows Google Cloud recommended access control patterns. Storing analytical logs in partitioned BigQuery tables alongside locked Cloud Storage compliance archives balances low-cost long-term retention with high-performance real-time analytics.

View source documentation

Professional Cloud DevOps Engineer

Securing Log Export Pipeline Compliance Retention

Professional Cloud DevOps Engineer

Securing Log Export Pipeline Compliance Retention

What the solution is

How it meets the requirements

Key advantages and capabilities

Why this is optimal

Related questions