Your team needs to obtain a unified log view of all development cloud projects in your SIEM. The development projects are under the NONPROD organization folder with the test and pre- production…

Question

Options

• A
  1. Export logs to a Cloud Pub/Sub topic with folders/NONPROD parent and includeChildren
• B
  1. Create a Cloud Storage sink with billingAccounts/ABC-BILLING parent and includeChildren
• C
  1. Export logs in each dev project to a Cloud Pub/Sub topic in a dedicated SIEM project.
• D
  1. Create a Cloud Storage sink with a publicly shared Cloud Storage bucket in each project.

• A
  80% (24)
• B
  10% (3)
• C
  3% (1)
• D
  7% (2)

Explanation

Option A is correct because creating an aggregated log sink with the folders/NONPROD parent and includeChildren=true captures logs from all child projects within that folder (including dev, test, and pre-prod) in a single export, and routing to Cloud Pub/Sub is the standard integration method for real-time SIEM ingestion.

Why the distractors fail:

• B uses the billing account as the parent, which would capture logs from all projects sharing that billing account across the entire organization - far broader than just development projects, violating the scoping requirement.
• C requires manually configuring a sink in each individual dev project, which is operationally expensive, error-prone, and not "unified" - it also doesn't scale as new projects are added.
• D uses Cloud Storage instead of Pub/Sub (wrong destination for real-time SIEM streaming), requires per-project setup, and a publicly shared bucket is a serious security anti-pattern.

Memory tip: Think of the parent resource as your "scope selector" - use the most specific folder that contains exactly the projects you need, pair it with includeChildren=true for automatic coverage, and always use Pub/Sub when the destination is a SIEM (real-time streaming), not Cloud Storage (which is for archival/batch).

No community discussion yet for this question.