GCP Professional Cloud Security Engineer Practice Question

Your company operates hundreds of projects spread across several folders in a single Google Cloud organization. Developers in each project rely on the default Cloud Logging buckets for day-to-day troubleshooting and must keep access to those logs. The Security Operations Center wants to run near-real-time SQL correlation queries across all VPC Flow Logs and Cloud IDS threat logs produced anywhere in the organization, but they do not want duplicate records to appear in the central dataset. Which solution provides the required visibility with the least operational overhead while preserving developers' existing log access?

Create a single organization-level aggregated sink with a filter that selects VPC Flow Logs and Cloud IDS threat logs, and route the sink to a BigQuery dataset in a dedicated security project. Leave the sink in its default non-intercepting mode.
Enable Log Analytics in each project and query the resulting BigQuery-powered log buckets through a shared BigQuery connection from the security project.
In every project, enable VPC Flow Logs and Cloud IDS, then create a project-level sink that exports the logs to a Pub/Sub topic which a centralized Dataflow job loads into BigQuery.
Create an organization-level aggregated sink with the intercepting option enabled so the selected logs are routed only to a BigQuery dataset in a security project, preventing them from reaching any child Log Router.

Report Issue

Answer Description

An organization-level aggregated sink automatically includes logs from every descendant folder and project, so it satisfies the requirement to capture all VPC Flow and Cloud IDS logs centrally without per-project maintenance. Leaving the sink in its default non-intercepting mode means the Log Router continues to route matching entries to the individual projects' default log buckets, so developers retain local visibility. Because the projects do not export those logs to the same BigQuery dataset, no duplicate records are written there. An intercepting sink would break developers' access, and creating hundreds of per-project pipelines or enabling Log Analytics in each project adds unnecessary operational burden.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.