Your company sends all Google Cloud logs to Cloud Logging. Your security team wants to monitor the logs. You want to ensure that the security team can react quickly if an anomaly such as an unwanted firewall change or server breach is detected. You want to follow Google-recommended practices. What should you do?

The Google-recommended practice for real-time log monitoring and response is an event-driven architecture using a log sink. You configure a sink in Cloud Logging with a specific filter to match anomaly events (e.g., firewall modifications). This sink exports matching log entries in real-time to a Pub/Sub topic. A Cloud Function is then configured with a Pub/Sub trigger, causing it to execute immediately whenever a relevant log is published to the topic. This provides the fastest possible reaction time, allowing for immediate alerting or automated remediation, which directly satisfies the requirement to "react quickly."

A: A cron job is a polling mechanism. It introduces inherent delays (up to the polling interval) and is less efficient than an event-driven push model for real-time needs. B: Exporting to BigQuery is ideal for batch analysis and forensics, not real-time alerting. There are delays in data ingestion and querying, making it too slow for immediate response. D: Exporting logs to Cloud Storage is a batch process, where logs are collected and written to files periodically. This latency makes it unsuitable for rapid, real-time event detection.

1. Google Cloud Documentation, "Scenarios for exporting logs," Section: "Real-time security and access monitoring". This section explicitly recommends exporting logs to Pub/Sub to be consumed by another application, such as Cloud Functions, for real-time analysis. (https://cloud.google.com/logging/docs/export/configureexportv2#scenarios)

2. Google Cloud Architecture Center, "Real-time log analysis for security and access analytics". This reference architecture details the pattern of using Cloud Logging -> Log Sink -> Pub/Sub -> Cloud Functions for real-time alerting and analysis. (https://cloud.google.com/architecture/real-time-log-analysis-for-security-and-access-analytics)

3. Google Cloud Documentation, "Overview of log routing and storage," Section: "Sinks". Sinks control how Cloud Logging routes logs. You can use sinks to route some or all of your logs to supported destinations, including Pub/Sub topics. (https://cloud.google.com/logging/docs/routing/overview#sinks)