Your organization is using Google Workspace, Google Cloud, and a third-party SIEM. You need to export events such as user logins, successful logins, and failed logins to the SIEM. Logs need to be…

The correct answer is D. Create a Cloud Logging sink to export relevant authentication logs to a Pub/Sub topic for SIEM. The recommended approach is to create a Cloud Logging sink that exports authentication logs (e.g., login successes and failures) to a Pub/Sub topic, which the SIEM can subscribe to. This enables real-time or near real-time log streaming from both Google Workspace and Google…

Submitted by jordan8· Apr 18, 2026Ensuring compliance

Question

Your organization is using Google Workspace, Google Cloud, and a third-party SIEM. You need to export events such as user logins, successful logins, and failed logins to the SIEM. Logs need to be ingested in real time or near real-time. What should you do?

Options

APoll Cloud Logging for authentication events using the gcloud logging read tool. Forward the
BConfigure Google Workspace to directly send logs to the API endpoint of the third-party SIEM.
CCreate a Cloud Storage bucket as a sink for all logs. Configure the SIEM to periodically scan the
DCreate a Cloud Logging sink to export relevant authentication logs to a Pub/Sub topic for SIEM

How the community answered

(38 responses)

A
13% (5)
B
5% (2)
C
8% (3)
D
74% (28)

Explanation

The recommended approach is to create a Cloud Logging sink that exports authentication logs (e.g., login successes and failures) to a Pub/Sub topic, which the SIEM can subscribe to. This enables real-time or near real-time log streaming from both Google Workspace and Google Cloud to the third-party SIEM, ensuring timely security monitoring and analysis.

Topics

#Cloud Logging#Pub/Sub#SIEM Integration#Real-time Log Export

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice