A financial enterprise requires a centralized, tamper-proof audit logging architecture across all Google Cloud projects within its organization. The compliance and security teams mandate the following technical requirements: Centralization: All organization-wide audit logs must be routed to a centralized Cloud Storage bucket residing in a dedicated sec-logging-prod project. Tamper resistance: Project administrators in individual child projects must not be able to disable or alter the logging pipeline. Data at rest: All exported log objects must be encrypted using a customer-managed encryption key (CMEK). Immutability: Logs must be protected against modification, overwriting, and deletion for a minimum compliance retention period of seven years (WORM compliance). Which architecture and set of configuration steps should the security engineer implement?

Create an aggregated log sink at the organization level with `--include-children` pointing to the storage bucket in `sec-logging-prod`. Grant the sink's `writerIdentity` the Storage Object Creator role (`roles/storage.objectCreator`) on the destination bucket, assign the Cloud KMS CryptoKey Encrypter/Decrypter role (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) to the Cloud Storage service agent on the CMEK key, and enforce a 7-year locked retention policy using Bucket Lock.: What the solution is This architecture establishes an aggregated log sink at the Google Cloud organization root that centrally captures and routes audit telemetry across all descendant folders and projects into a hardened, CMEK-encrypted, and WORM-compliant Cloud Storage bucket. How it meets the requirements Centralization & Child Coverage: Creating an organization-level sink configured with --include-children automatically aggregates logs across every current and future child folder and project, routing them directly to the designated Cloud Storage bucket in sec-logging-prod. Tamper Resistance: Because the sink is established at the organization node, project-level administrators lack the IAM permissions required to update, disable, or delete the sink at the root level. Least-Privilege Routing Permissions: Granting roles/storage.objectCreator to the sink's unique writerIdentity service account allows Cloud Logging to write new log objects to the destination bucket without granting unnecessary read or delete capabilities. CMEK Encryption: Binding roles/cloudkms.cryptoKeyEncrypterDecrypter to the Cloud Storage service agent ensures all incoming log objects written to the bucket are encrypted using customer-controlled keys in Cloud KMS. WORM Immutability: Applying a 7-year retention policy and permanently locking it with Cloud Storage Bucket Lock prevents any user—including Organization Administrators and Project Owners—from modifying or deleting log objects until the retention timer has elapsed. Key advantages Unified governance: Automatically incorporates new projects into audit pipelines without manual onboarding. Strict separation of duties: Keeps audit storage under dedicated security administrators. Cryptographic control: Allows key rotation, disabling, or destruction in Cloud KMS. Immutable compliance: Meets strict SEC 17a-4, FINRA, and GDPR regulatory audit standards. Why this is optimal Aggregated sinks configured at the organization root combined with locked bucket retention policies and CMEK provide an end-to-end zero-trust logging architecture that completely isolates security records from individual workload owners.

StudyCerts

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Centralized Audit Log Routing Cmek Bucket Lock

Section: Designing secure access to logs.

A financial enterprise requires a centralized, tamper-proof audit logging architecture across all Google Cloud projects within its organization. The compliance and security teams mandate the following technical requirements:

Centralization: All organization-wide audit logs must be routed to a centralized Cloud Storage bucket residing in a dedicated sec-logging-prod project.
Tamper resistance: Project administrators in individual child projects must not be able to disable or alter the logging pipeline.
Data at rest: All exported log objects must be encrypted using a customer-managed encryption key (CMEK).
Immutability: Logs must be protected against modification, overwriting, and deletion for a minimum compliance retention period of seven years (WORM compliance).

Which architecture and set of configuration steps should the security engineer implement?

Update the default _Required and _Default sinks in every project to route to a BigQuery dataset in sec-logging-prod. Grant the BigQuery Data Editor role (roles/bigquery.dataEditor) to the Organization Administrator, encrypt the BigQuery tables with CMEK, and configure table expiration set to seven years.

Create individual project-level sinks in each child project pointing to the storage bucket in sec-logging-prod. Grant the Storage Admin role (roles/storage.admin) to the default Compute Engine service account, configure default Google-managed encryption on the destination bucket, and configure an Object Lifecycle Management rule to delete objects after seven years.

Create an organization-level aggregated sink routed to a Pub/Sub topic in sec-logging-prod. Grant the sink's writerIdentity the Pub/Sub Publisher role (roles/pubsub.publisher), enable customer-managed encryption keys on the topic, and configure a Cloud Storage subscription that uses soft delete to prevent log deletion.

Create an aggregated log sink at the organization level with --include-children pointing to the storage bucket in sec-logging-prod. Grant the sink's writerIdentity the Storage Object Creator role (roles/storage.objectCreator) on the destination bucket, assign the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) to the Cloud Storage service agent on the CMEK key, and enforce a 7-year locked retention policy using Bucket Lock.

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Centralized Audit Log Routing Cmek Bucket Lock

Section: Designing secure access to logs.

Centralization: All organization-wide audit logs must be routed to a centralized Cloud Storage bucket residing in a dedicated sec-logging-prod project.
Tamper resistance: Project administrators in individual child projects must not be able to disable or alter the logging pipeline.
Data at rest: All exported log objects must be encrypted using a customer-managed encryption key (CMEK).
Immutability: Logs must be protected against modification, overwriting, and deletion for a minimum compliance retention period of seven years (WORM compliance).

Which architecture and set of configuration steps should the security engineer implement?

Explanations

What the solution is

This architecture establishes an aggregated log sink at the Google Cloud organization root that centrally captures and routes audit telemetry across all descendant folders and projects into a hardened, CMEK-encrypted, and WORM-compliant Cloud Storage bucket.

How it meets the requirements

Centralization & Child Coverage: Creating an organization-level sink configured with --include-children automatically aggregates logs across every current and future child folder and project, routing them directly to the designated Cloud Storage bucket in sec-logging-prod.
Tamper Resistance: Because the sink is established at the organization node, project-level administrators lack the IAM permissions required to update, disable, or delete the sink at the root level.
Least-Privilege Routing Permissions: Granting roles/storage.objectCreator to the sink's unique writerIdentity service account allows Cloud Logging to write new log objects to the destination bucket without granting unnecessary read or delete capabilities.
CMEK Encryption: Binding roles/cloudkms.cryptoKeyEncrypterDecrypter to the Cloud Storage service agent ensures all incoming log objects written to the bucket are encrypted using customer-controlled keys in Cloud KMS.
WORM Immutability: Applying a 7-year retention policy and permanently locking it with Cloud Storage Bucket Lock prevents any user—including Organization Administrators and Project Owners—from modifying or deleting log objects until the retention timer has elapsed.

Key advantages

Unified governance: Automatically incorporates new projects into audit pipelines without manual onboarding.
Strict separation of duties: Keeps audit storage under dedicated security administrators.
Cryptographic control: Allows key rotation, disabling, or destruction in Cloud KMS.
Immutable compliance: Meets strict SEC 17a-4, FINRA, and GDPR regulatory audit standards.

Why this is optimal

Aggregated sinks configured at the organization root combined with locked bucket retention policies and CMEK provide an end-to-end zero-trust logging architecture that completely isolates security records from individual workload owners.

View source documentation

Professional Cloud Security Engineer

Centralized Audit Log Routing Cmek Bucket Lock

Professional Cloud Security Engineer

Centralized Audit Log Routing Cmek Bucket Lock

What the solution is

How it meets the requirements

Key advantages

Why this is optimal

Related questions