GCP Professional Cloud Architect Practice Question
A publicly traded company must retain Google Cloud Admin Activity audit logs for seven years to satisfy regional financial regulations. The compliance team also requires the logs to be immutable once written so that even project owners cannot delete or overwrite them. As the Cloud Architect, you need to propose a solution that satisfies the requirements while adding the least operational overhead.
Which design should you recommend?
Export the logs to Pub/Sub and invoke a Cloud Function that writes them to Firestore collections configured with a seven-year TTL.
Retain the logs in their default Cloud Logging bucket and set the bucket's retention period to seven years.
Route the logs to a BigQuery dataset with a seven-year table expiration and grant only BigQuery Data Viewer roles to administrators.
Create a log sink that routes Admin Activity logs to a Cloud Storage bucket in a dedicated compliance project, enable a seven-year retention policy on the bucket, and lock the policy with Bucket Lock.
Exporting the logs with a log sink to a dedicated Cloud Storage bucket and then applying a bucket-level retention policy that is permanently locked meets both needs:
Cloud Storage Bucket Lock makes the retention policy immutable; no principal (including project owners) can shorten the period or delete objects until the seven-year term has elapsed.
A storage bucket needs virtually no maintenance and supports uniform IAM, so operational overhead stays low.
BigQuery datasets and Cloud Logging buckets let privileged users change retention settings, so they do not guarantee immutability. Pub/Sub-to-Firestore adds unnecessary moving parts and does not provide write-once protection.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a log sink in Google Cloud?
Open an interactive chat with Bash
What is Bucket Lock, and how does it ensure immutability?
Open an interactive chat with Bash
Why is Cloud Storage recommended over BigQuery for long-term log retention?
Open an interactive chat with Bash
What is Bucket Lock in Google Cloud Storage?
Open an interactive chat with Bash
What is a log sink in Google Cloud, and how does it work?