CLOUD-SECURITY-ENGINEER practice question 35 of 35

Your team needs to obtain a unified log view of all development cloud projects in your SIEM. The development projects are under the NONPROD organization folder with the test and pre-production projects. The development projects share the ABC-BILLING billing account with the rest of the organization. Which logging export strategy should you use to meet the requirements?

Answer options

A: 1. Export logs to a Cloud Pub/Sub topic with folders/NONPROD parent and includeChildren property set to True in a dedicated SIEM project. 2. Subscribe SIEM to the topic.

B: 1. Create a Cloud Storage sink with billingAccounts/ABC-BILLING parent and includeChildren property set to False in a dedicated SIEM project. 2. Process Cloud Storage objects in SIEM.

C: 1. Export logs in each dev project to a Cloud Pub/Sub topic in a dedicated SIEM project. 2. Subscribe SIEM to the topic. Correct answer

D: 1. Create a Cloud Storage sink with a publicly shared Cloud Storage bucket in each project. 2. Process Cloud Storage objects in SIEM.

Correct Answer:

C. 1. Export logs in each dev project to a Cloud Pub/Sub topic in a dedicated SIEM project. 2. Subscribe SIEM to the topic.

Explanation

Folder-level sinks cannot selectively exclude child projects; therefore exporting from each development project to a central Pub/Sub topic is the only way to obtain just the development logs in the SIEM while leaving test and pre-prod logs untouched.

Why Incorrect

A. A folder-level sink with includeChildren=True exports ALL projects in NONPROD, including test and pre-prod.
B. Billing-account sinks export billing-related-logs only, not application/activity logs.
D. Public buckets create security risk and duplicate storage costs; separate buckets per project give no unified stream.

References

1. Cloud Logging – “About sinks” (includeChildren exports all descendants)

§Resource hierarchy sinks

https://cloud.google.com/logging/docs/export/configureexport#about-sinks

2. Cloud Logging – “Routing logs by project

folder

or organization”

§Selective exports

https://cloud.google.com/logging/docs/export/routing#sinks

Keep practicing

Take the free CLOUD-SECURITY-ENGINEER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test