Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud DevOps Engineer practice bank has 1,455 more like it. Try 10 free: instant score, no account.
Your organization is designing an enterprise log export and retention pipeline in Google Cloud to meet strict financial regulatory standards.
The pipeline architecture has the following compliance and operational requirements:
Which combination of actions should you implement?
This solution implements a secure, compliance-ready log ingestion and archival pipeline across Cloud Logging, Cloud Storage, and BigQuery. It pairs automated log routing with immutable object retention and cost-optimized, time-partitioned analytical storage.
roles/storage.objectCreator allows the log sink's unique writer identity service account to write audit logs into the Cloud Storage bucket without granting permissions to read, overwrite, or delete existing objects. Similarly, granting roles/bigquery.dataEditor scoped strictly to the target BigQuery dataset enables seamless log streaming.Using Cloud Logging sinks paired with dedicated writer identities avoids credential sharing and follows Google Cloud recommended access control patterns. Storing analytical logs in partitioned BigQuery tables alongside locked Cloud Storage compliance archives balances low-cost long-term retention with high-performance real-time analytics.
This option relies on standard Object Versioning in Cloud Storage and table sharding (e.g., table_YYYYMMDD) in BigQuery, using broad project-level permissions granted to the default Compute Engine service account.
roles/storage.admin and roles/bigquery.admin to the default Compute Engine service account provides sweeping administrative access across the entire project rather than scoped write permissions for the sink writer identity.The requirement was to maintain a basic version history for general development environments where administrative overrides and version rollbacks are explicitly permitted.
This option exports audit logs to a Cloud Storage bucket where the retention policy is not locked, writes logs into a non-partitioned BigQuery table relying on long-term storage pricing discounts, and assigns project Owner permissions to the sink writer identity.
roles/owner role grants unrestricted control over all Google Cloud resources in the project, which is unnecessary and poses a major security risk.DELETE queries that incur compute costs.The environment required temporary archival storage during initial testing where policies needed frequent administrative adjustments and full project ownership was acceptable.
_Required log bucket with custom 7-year retention, and route analytical logs to Cloud SQL using a custom service account with the Cloud SQL Admin role.This option attempts to retain audit logs by customizing the retention period of the built-in _Required log bucket in Cloud Logging and routes analytical logs into a Cloud SQL database.
_Required log bucket has a fixed, non-configurable retention period of 400 days; it cannot be extended to 7 years (2,555 days).roles/cloudsql.admin role grants full administrative control over Cloud SQL instances, which is excessive for an ingestion pipeline that only writes logs._Required log bucket cannot be deleted or have its retention modified.The objective was to retain mandatory admin activity audit logs within Cloud Logging for standard operational auditing up to 400 days without additional export infrastructure.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated