GCP Professional Cloud Security Engineer Practice Question

Your company runs hundreds of Google Cloud projects. VPC Flow Logs, Firewall Rules Logging, and Cloud IDS are enabled everywhere, and an organization-level log retention policy already applies through a centralized Cloud Logging bucket. Security operations engineers now request the ability to run ad-hoc SQL joins that correlate findings from Cloud IDS with VPC Flow Logs across all projects. You must satisfy this request while 1) re-using existing Cloud Logging access controls, 2) avoiding the overhead of managing separate analytical storage, and 3) keeping additional storage costs to a minimum. What should you do?

Stream all network logs to Pub/Sub and process them with a Dataflow pipeline that writes into a manually managed BigQuery dataset; have the SOC query the dataset with SQL.
Forward network logs to Security Command Center and use its query interface to perform the required cross-log correlation analysis.
Create an aggregated sink at the organization level that routes all network logs into a new centralized log bucket and enable Log Analytics on that bucket; instruct SOC analysts to run SQL queries from Logs Explorer against the bucket.
Configure a project-level log sink in every project that exports network logs to a dedicated BigQuery dataset; grant the SOC BigQuery Data Viewer access so they can run SQL joins in the BigQuery console.

Report Issue

Answer Description

Upgrading (or creating) a centralized log bucket with Log Analytics turns that Cloud Logging bucket into a BigQuery-backed view that can be queried with standard SQL from Logs Explorer. The underlying BigQuery dataset is provisioned and managed automatically by Cloud Logging, so you do not need to build or operate separate export pipelines or datasets, and the data remains governed by the same Cloud Logging IAM policies applied to the bucket. Exporting or streaming logs to an external BigQuery dataset (or to Cloud Storage and then loading into BigQuery) would duplicate data, require additional infrastructure, and incur extra storage costs. Security Command Center and Cloud Trace do not provide the required ad-hoc SQL join capability over raw network log entries. Therefore, enabling Log Analytics on an organization-level aggregated log bucket best meets all the stated requirements.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.