Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your enterprise organization needs to centralize logging across all current and future projects into a dedicated project named logging-prod.
The design must meet the following requirements:
StudyCerts
StudyCertslogging-prod._Default log buckets to control storage costs, while ensuring mandatory system audit logs remain stored in each originating project's _Required bucket.Which logging architecture should you implement?
Create a non-intercepting aggregated log sink at the organization level with the include-children flag targeting the custom Log Bucket URI in logging-prod directly, and grant the sink's writerIdentity the Logs Bucket Writer role on the destination project.
Create an intercepting aggregated log sink at the organization level with the include-children and intercept-children flags set to route logs to the logging-prod project, configure a log sink in logging-prod to route incoming entries into the custom Log Bucket, and grant the aggregated sink's writerIdentity the Logs Writer role on logging-prod.
Create an intercepting aggregated log sink at the organization level with the include-children and intercept-children flags, set the sink destination directly to the custom Log Bucket URI in logging-prod, and grant the Logs Bucket Writer role.
Deploy individual project-level log sinks across all existing projects to route Data Access logs to logging-prod, and disable the system-created _Default sink in every child project using default resource settings.
Create a non-intercepting aggregated log sink at the organization level with the include-children flag targeting the custom Log Bucket URI in logging-prod directly, and grant the sink's writerIdentity the Logs Bucket Writer role on the destination project.
Create an intercepting aggregated log sink at the organization level with the include-children and intercept-children flags set to route logs to the logging-prod project, configure a log sink in logging-prod to route incoming entries into the custom Log Bucket, and grant the aggregated sink's writerIdentity the Logs Writer role on logging-prod.
An intercepting aggregated log sink is an organization-level or folder-level routing rule configured in Cloud Logging that captures log entries from the parent resource and all child resources. Unlike non-intercepting sinks, an intercepting sink halts the downstream evaluation of matching log entries in child resources, preventing them from being processed by child-level sinks (such as the system-created _Default sink) while still guaranteeing delivery to the originating project's _Required sink.
--include-children automatically encompasses all existing and newly created folders and projects without manual intervention.--intercept-children (or setting interceptChildren: true), matching Data Access logs are intercepted and withheld from project-level _Default sinks, avoiding duplicate ingestion charges across hundreds of projects._Required log sink in the originating resource, ensuring Admin Activity and System Event logs remain compliant at the project boundary.logging-prod) then reroute the entries into storage repositories like custom Log Buckets. Granting Logs Writer (roles/logging.logWriter) to the sink's generated writerIdentity service account satisfies least-privilege destination access.This architecture is the only design that strictly complies with Google Cloud's routing model: intercepting aggregated sinks must terminate at a project destination, where local sinks manage secondary delivery to custom Log Buckets while protecting child projects from double-storage costs.
Create an intercepting aggregated log sink at the organization level with the include-children and intercept-children flags, set the sink destination directly to the custom Log Bucket URI in logging-prod, and grant the Logs Bucket Writer role.
Deploy individual project-level log sinks across all existing projects to route Data Access logs to logging-prod, and disable the system-created _Default sink in every child project using default resource settings.