You are tasked with exporting and auditing security logs for login activity events for Google Cloud console and API calls that modify configurations to Google Cloud resources. Your export must meet…

Question

Options

• ACreate a Log Sink at the organization level with a Pub/Sub destination.
• BCreate a Log Sink at the organization level with the includeChildren parameter, and set the
• CEnable Data Access audit logs at the organization level to apply to all projects.
• DEnable Google Workspace audit logs to be shared with Google Cloud in the Admin Console.
• EEnsure that the SIEM processes the AuthenticationInfo field in the audit log entry to gather

• A
  4% (1)
• B
  81% (22)
• C
  4% (1)
• E
  11% (3)

Explanation

The correct answers are B and D. B is required because creating a Log Sink at the organization level with the 'includeChildren' parameter ensures logs are aggregated from ALL projects in the organization, and setting the destination to Pub/Sub enables near real-time streaming to an external SIEM. A is incorrect because it lacks 'includeChildren', so it would only export organization-level logs, missing project logs. D is required because login activity events for the Google Cloud console originate from Google Workspace identity (Google accounts). Enabling Google Workspace audit logs to be shared with Google Cloud makes these Admin Activity/Login events visible within Cloud Audit Logs. C (Data Access audit logs) captures data-read/write operations, not the configuration-modification and login events specified. E describes a downstream processing step, not an export configuration.

No community discussion yet for this question.