Crucial Exams

GCP Professional Cloud Security Engineer Practice Question

Your organization aggregates all project logs into a centralized log bucket called org-logs. A security investigation team must see every log entry, including Data Access events, while application developers should see only log entries whose resource.labels.service_name="orders-service" field matches their micro-service and should never see Data Access logs or other services' traffic. What is the most secure and maintainable way to meet both requirements?

  • Enable Data Access logs at the project level and require developers to use the Logs Explorer's query builder for filtering; give everyone roles/logging.privateLogViewer on the org-logs bucket.

  • Grant the security team roles/logging.privateLogViewer on the org-logs bucket and give developers roles/logging.viewer on a log view that filters to the orders-service entries and excludes Data Access logs.

  • Create two additional log buckets: one with a sink that routes only orders-service logs for developers and one with all logs for the security team; grant both parties roles/logging.viewer on their respective buckets.

  • Export all Data Access logs to BigQuery, grant the security team the BigQuery Data Viewer role on the dataset, and allow developers to query the dataset with row-level access policies that expose only orders-service rows.

GCP Professional Cloud Security Engineer
Managing operations
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot