GCP Professional Cloud Security Engineer Practice Question

An organization-level aggregated Log Router sink that exports every Cloud Audit Log entry (both Admin Activity and Data Access) to a centralized BigQuery dataset meets the seven-year retention and searchability requirements while requiring only a single configuration. BigQuery allows time-partitioned tables whose partition expiration can be set (for example, to 2 555 days ≈ 7 years) so the logs are kept for the mandated period and then automatically deleted.

Increasing Cloud Logging's built-in retention is impossible beyond its fixed limits (400 days for Admin Activity/System Event, 30 days for Data Access). Creating per-project sinks multiplies administrative overhead, and exporting to Pub/Sub and then into Cloud SQL adds unnecessary components and operational burden. Exporting only Admin Activity to Cloud Storage omits the required Data Access logs and does not provide the same interactive querying capability without additional loading steps.