Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your enterprise organization consists of hundreds of Google Cloud projects organized across multiple folders. To comply with strict security standards, you must centralize all Data Access audit logs generated across the organization into a dedicated project named sec-central-logging.
Your design must satisfy the following criteria:
StudyCerts
StudyCerts_Default log buckets, preventing unauthorized local access and unnecessary storage costs._Required sink must continue to be routed normally to their local _Required log bucket.How should you configure the log routing architecture?
Create an intercepting aggregated log sink at the organization level targeting the project sec-central-logging, set --include-children and --intercept-children, and specify an inclusion filter for Data Access audit logs.
Configure organization-level default resource settings to disable the _Default sink across all projects, and use a script to deploy individual project-level sinks routing Data Access audit logs to sec-central-logging.
Create an intercepting aggregated log sink at the organization level targeting a dedicated Cloud Logging bucket directly, set --include-children and --intercept-children, and specify an inclusion filter for Data Access audit logs.
Create a non-intercepting aggregated log sink at the organization level targeting a Cloud Logging bucket in sec-central-logging, set --include-children, and specify an inclusion filter for Data Access audit logs.
Create an intercepting aggregated log sink at the organization level targeting the project sec-central-logging, set --include-children and --intercept-children, and specify an inclusion filter for Data Access audit logs.
An intercepting aggregated log sink is an organization- or folder-level log router sink configured with both --include-children and --intercept-children. It collates log entries from all descendant folders and projects while altering the normal hierarchical log flow.
--include-children ensures that log entries from all existing and future child projects and folders are captured._Default) lower in the hierarchy._Required sink routing: The Log Router architecture guarantees that even when an intercepting aggregated sink matches a log entry, the entry is still delivered to the project-level _Required sink in the originating resource.logging.googleapis.com/projects/sec-central-logging), where destination-level sinks can then manage final storage._Required audit entries.This approach natively enforces hierarchical log containment using Cloud Logging Log Routers, fulfilling all security and cost boundaries without manual sink management in individual projects.
Configure organization-level default resource settings to disable the _Default sink across all projects, and use a script to deploy individual project-level sinks routing Data Access audit logs to sec-central-logging.
Create an intercepting aggregated log sink at the organization level targeting a dedicated Cloud Logging bucket directly, set --include-children and --intercept-children, and specify an inclusion filter for Data Access audit logs.
Create a non-intercepting aggregated log sink at the organization level targeting a Cloud Logging bucket in sec-central-logging, set --include-children, and specify an inclusion filter for Data Access audit logs.