Google Professional Cloud Security Engineer

Get started today

Ultimate access to all questions.

Quick Answer

Answer-first summary for fast verification

Answer: 1. Create one log sink at the organization level that includes all the child resources. 2. Use as destination a Pub/Sub topic to ingest the logs into the security information and event. management (SIEM) on-premises, and ensure that the right team can access the SIEM. 3. Grant the Viewer role at organization level to the security operations team.

Option B is the correct answer because it addresses the core requirements effectively: creating a single organization-level log sink with all child resources included centralizes logging across 200 projects, providing uniform visibility. Using Pub/Sub as the destination allows integration with an on-premises SIEM for analysis, which is practical for security operations. Granting the Viewer role at the organization level enables the security team to view environment configurations across all projects. Option A is inefficient due to per-project sinks and lacks direct SIEM integration. Option C fails to create log sinks, preventing centralized visibility. Option D's exclusion of child resources in one sink and the Security Reviewer role (which focuses on policy review, not log access) make it suboptimal compared to B's comprehensive approach.

Author: LeetQuiz Editorial Team

Quick Answer

Answer-first summary for fast verification

Author: LeetQuiz Editorial Team

Comments (0)

No comments yet.

Your company's Google Cloud organization has approximately 200 projects and 1,500 virtual machines. The lack of a uniform logs and events management strategy is reducing visibility for your security operations team. You need to design a logging solution that provides visibility and enables the security team to view the environment's configuration.

What should you do?

Exam-Like

Create a dedicated log sink for each project that is in scope.
Use a BigQuery dataset with time partitioning enabled as a destination of the log sinks.
Deploy alerts based on log metrics in every project.
Grant the role "Monitoring Viewer" to the security operations team in each project.

0.0%

Create one log sink at the organization level that includes all the child resources.
Use as destination a Pub/Sub topic to ingest the logs into the security information and event. management (SIEM) on-premises, and ensure that the right team can access the SIEM.
Grant the Viewer role at organization level to the security operations team.

40.0%

Enable network logs and data access logs for all resources in the "Production" folder.
Do not create log sinks to avoid unnecessary costs and latency.
Grant the roles "Logs Viewer" and "Browser" at project level to the security operations team.

Powered ByGPT 5.4

Create one sink for the "Production" folder that includes child resources and one sink for the logs ingested at the organization level that excludes child resources.
As destination, use a log bucket with a minimum retention period of 90 days in a project that can be accessed by the security team.
Grant the security operations team the role of Security Reviewer at organization level.