You work for a multinational organization that has systems deployed across multiple cloud providers, including Google Cloud. Your organization maintains an extensive on-premises security information…

Question

Options

• ACreate a Pub/Sub topic for log aggregation. Write a custom Python script on a Cloud Function
• BCollect all logs into an organization-level aggregated log sink and send the logs to a Pub/Sub
• CDeploy a Cloud Logging sink with a filter that routes all logs directly to a syslog endpoint. The
• DUtilize custom firewall rules to allow your SIEM to directly query Google Cloud logs. Implement a

• A
  5% (1)
• B
  74% (14)
• C
  5% (1)
• D
  16% (3)

Explanation

The correct architecture is: organization-level aggregated log sink → Pub/Sub topic → Dataflow pipeline → on-premises SIEM. An organization-level aggregated sink collects logs from all projects in one place. Routing to Pub/Sub provides a durable message queue with configurable message retention, which guarantees re-delivery if the SIEM endpoint is temporarily unavailable - directly addressing the fault tolerance requirement. Dataflow provides auto-scaling stream processing to push logs to the SIEM in near real-time. Option A uses a Cloud Function for forwarding, which lacks Dataflow's auto-scaling and Pub/Sub's built-in retry durability. Option C routes directly to a syslog endpoint with no message queuing, so failed deliveries are lost. Option D relies on SIEM-side pull queries through firewall rules, which is not push-based and introduces complex pull scheduling.

No community discussion yet for this question.