GCP Professional Cloud Security Engineer Practice Question

A security team created an aggregated sink at the prod folder level with includeChildren set to true. The sink exports all Audit Logs generated in that folder to a BigQuery dataset that resides in a dedicated security-project. Soon after activation, the dataset starts to receive duplicate log entries that originate from the security-project itself, which is not part of the prod folder. You must keep exporting every audit log produced by projects in the prod folder, but avoid re-exporting any log entries that originate in the security-project. Which change will solve the problem with the least ongoing maintenance effort?

Reconfigure the existing folder-level aggregated sink to operate in non-intercepting mode so it ignores log entries that have already been exported to another sink.
Edit the sink filter to add a condition that excludes any entries where resource.labels.project_id equals security-project.
Delete the aggregated sink and create individual project sinks in every prod project, each exporting to the BigQuery dataset.
Move the sink to the organization root and add an exclusion filter for logName:projects/security-project.

Report Issue

Answer Description

Aggregated sinks have two operating modes. In their default non-intercepting mode they export log entries only if those entries haven't already been delivered to another sink further down the resource hierarchy. If an aggregated sink is switched to intercepting mode, it re-exports any log entry that matches its filter, even if that entry was already exported by another sink - including log entries created in the destination project. Because the team is seeing recursive exports from the security-project, the sink must currently be configured as intercepting. Returning it to the default non-intercepting behavior stops the recursion while still exporting all logs from child projects in the prod folder. The other options either introduce higher operational overhead (multiple project sinks or complex exclusion filters) or move the sink to a broader scope while still requiring manual exclusions.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.