Crucial Exams

GCP Professional Cloud Security Engineer Practice Question

Your organization has a folder called "Production" with hundreds of projects. A separate security project hosts a regional europe-west4 log bucket named "prod-audit-logs" protected by a customer-managed encryption key (CMEK). You must copy all Cloud Audit Logs (Admin Activity, Data Access, System Event, Policy Denied) from every current and future project under Production into that bucket. Project administrators must not be able to alter or delete the exported logs, and the solution should require minimal ongoing maintenance. What should you do?

  • Create an organization-level aggregated sink without filters that exports all logs to a CMEK-protected BigQuery dataset in europe-west4 and grant the dataset Data Editor role to the organization's Logs Router service account.

  • Configure a sink on the Production folder that exports logs to a Pub/Sub topic. Subscribe a Cloud Functions service that writes incoming messages into the "prod-audit-logs" bucket and grant its runtime service account the Storage Object Admin role.

  • In every Production project, create an individual sink that exports Cloud Audit Logs to a Cloud Storage bucket in the security project, enable object versioning for immutability, and rely on inherited IAM policies to restrict deletions.

  • Create a regional log bucket "prod-audit-logs" in the security project with CMEK. At the Production folder, create an aggregated sink with includeChildren=true and a filter matching cloudaudit.googleapis.com/* entries. Set the destination to logging.googleapis.com/projects/SECURITY_PROJECT/locations/europe-west4/buckets/prod-audit-logs and grant the folder's Logs Router service account the Logging Bucket Writer role on that bucket.

GCP Professional Cloud Security Engineer
Managing operations
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot