A multinational enterprise wants to implement a centralized log routing and analytical strategy across its Google Cloud organization. The security operations team defines the following requirements: Aggregate and store Cloud Audit Logs centrally in a dedicated security monitoring project. Perform SQL-based analytics and Looker Studio reporting directly on log entries without duplicating raw log storage or paying separate BigQuery ingestion streaming fees. Ingest Data Access audit logs while actively excluding high-volume, routine read and list operations against Cloud Storage buckets and objects. Which architecture and filter configuration should the security engineer deploy?

Create an organization-level aggregated sink pointing to a user-defined Cloud Logging bucket upgraded for Log Analytics with a linked BigQuery dataset, using the inclusion filter: `log_id("cloudaudit.googleapis.com/data_access") AND NOT protoPayload.methodName =~ "^storage\.(buckets|objects)\.(get|list)$"`: What the solution is This solution pairs an organization-level aggregated log sink with a specialized Cloud Logging bucket upgraded for Log Analytics, integrated with BigQuery via a linked dataset and tuned with a regular expression filter in the Logging query language. How it meets all requirements Centralized aggregation: Creating an aggregated sink at the organization root routes matching log records from all child folders and projects into the centralized security monitoring project. SQL queries without double storage charges: Upgrading the destination log bucket to use Log Analytics enables standard SQL query capabilities in the Google Cloud console. Creating a linked BigQuery dataset allows BigQuery Studio and Looker Studio to query the data in place via the BigQuery engine without copying or streaming duplicate rows into standalone BigQuery native storage tables. Data Access tuning: The filter expression isolates Data Access logs (log_id("cloudaudit.googleapis.com/data_access")) while using regex matching (=~) and negation (NOT) to discard high-volume, low-fidelity Cloud Storage object and bucket get and list methods. Key advantages and capabilities Cost efficiency: Eliminates duplicate log ingestion and data streaming charges into BigQuery storage. Advanced analytics: Provides complete BigQuery SQL syntax support, including nested field parsing, aggregations, and joins against reference datasets. Precise stream isolation: The regex pattern ^storage\.(buckets|objects)\.(get|list)$ accurately matches storage.buckets.get, storage.buckets.list, storage.objects.get, and storage.objects.list in a single concise evaluation. Why this is optimal Using a Log Analytics linked dataset fulfills SQL analytics and reporting needs while retaining native Cloud Logging retention and security boundaries, avoiding the maintenance overhead and storage multiplication of traditional multi-destination exports.

Centralized Audit Log Sink Filter Destination | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

A financial services organization must implement a centralized log export architecture across all Google Cloud resources to comply with strict regulatory frameworks. The compliance and security requirements are: Comprehensive Audit Coverage: All audit logs from existing and future folders and projects across the organization must be captured automatically. Data Residency: Log archives must strictly reside in a designated geographic region (europe-west3). Tamper Resistance & Least Privilege: The log delivery mechanism must be restricted to write-only permissions on the destination archive to prevent exfiltration, modification, or deletion, while project administrators in child projects must have no access to alter or delete centralized logs. Which log export and IAM configuration should the security team implement?

Configuring log exports (log sinks and aggregated sinks).

AdvancedProfessional Cloud Security Engineer

An enterprise organization wants to centralize Data Access audit logs generated across all child projects within a folder named Production into a dedicated project named sec-ops-logging. The security team must satisfy the following architectural and operational requirements: All Data Access audit logs originating in existing and future child projects under the Production folder must automatically route to the central destination. To eliminate unnecessary storage costs and data duplication, matching Data Access audit logs must not be ingested or stored in the child projects' _Default log buckets. Mandatory Admin Activity logs must continue to flow to the _Required log bucket within each local originating project. Which sink configuration should the security engineer implement to achieve this goal?

Configuring log exports (log sinks and aggregated sinks).

AdvancedProfessional Cloud Security Engineer

A financial organization is establishing baseline compute and workload security controls on Google Cloud to comply with strict regulatory mandates. The architecture includes workloads running on Compute Engine instances and Google Kubernetes Engine (GKE) clusters. The regulatory framework requires the following technical safeguards: Data-in-use protection: Sensitive data must remain encrypted in host memory during execution. Boot integrity: Nodes and virtual machines must detect and prevent boot-level rootkits and kernel tampering. Workload supply chain integrity: Only cryptographically verified and attested container images can be deployed to production clusters. Host hardening and exposure reduction: Node operating systems must have a minimal attack surface and avoid direct public internet exposure. Which combination of Google Cloud security controls and configurations should the organization implement to satisfy these compliance requirements?

Determining technical needs relative to compute, data, network, and storage.

AdvancedProfessional Cloud Security Engineer

An enterprise maintains a hybrid architecture connecting an on-premises data center to a Google Cloud Virtual Private Cloud (VPC) over Cloud Interconnect. The organization has established the following security and networking requirements for name resolution: On-premises clients must resolve internal Google Cloud private DNS zones and Private Service Connect endpoints. Google Cloud Compute Engine instances must resolve corporate domains hosted on on-premises domain controllers without manually modifying client resolver configurations. The security operations center (SOC) must monitor and audit all name resolution requests to detect domain generation algorithm (DGA) query patterns and potential DNS data exfiltration attempts. Which Cloud DNS design and policy configuration should the security engineer implement to satisfy these requirements?

Configuring Cloud DNS security settings.

AdvancedProfessional Cloud Security Engineer

A financial enterprise deploys custom-trained classification models to Vertex AI to predict sensitive loan outcomes. A cloud security engineer is tasked with establishing security controls across the model deployment pipeline and inference serving layer to meet the following requirements: Model Governance & Integrity: Maintain centralized lifecycle management with distinct versioning in Vertex AI Model Registry, and enforce cryptographic verification of model artifacts prior to deployment to prevent tampering. Privacy & Attack Mitigation: Prevent model inversion and membership inference attacks that attempt to reconstruct private training data from the prediction API responses. Network Isolation: Ensure client workloads within the enterprise Virtual Private Cloud (VPC) reach the inference endpoint privately without routing over the public internet. Which combination of controls should the security engineer implement?

Implementing security and privacy controls for AI/ML systems to protect against unintentional exploitation of data or models.

FundamentalAssociate Data Practitioner

BigQuery Generative AI Functions

Use pretrained Google large language models (LLMs) using remote connection in BigQuery

Professional Cloud Security Engineer

Centralized Audit Log Sink Filter Destination

Related questions

BigQuery Generative AI Functions

Professional Cloud Security Engineer

Centralized Audit Log Sink Filter Destination

What the solution is

How it meets all requirements

Key advantages and capabilities

Why this is optimal

Related questions

BigQuery Generative AI Functions

What the solution is

How it meets all requirements

Key advantages and capabilities

Why this is optimal