Practice Test 1 | Google Cloud Certified Professional Cloud Architect | Dumps | Mock Test
Using the principle of least privilege and allowing for maximum automation, what steps can you take to store audit logs for the long term and to allow access for external auditors to view them? (Select TWO)
A. Generate a signed URL of the GCS bucket for auditors to access.
B. Create an account for auditors to have view access to Operations Suite (formerly Stackdriver) Logging.
C. Export audit logs to Cloud Storage via an export sink.
D. Export audit logs to BigQuery via an export sink.
Correct Answer: A and C
C (Correct answer) – Export audit logs to Cloud Storage via an export sink. Cloud Storage is the perfect solution for long-term logs storage.
There is 3 type of sink destinations you can export Operations Suite (formerly Stackdriver) Logs to Cloud Storage, Cloud Pub/Sub, BigQuery. While you could export to BigQuery for low-cost storage, BigQuery is mainly and best for analysis not for long-term storage. Besides, whenever you need to do analysis with BigQuery, you can always easily export the logs from GCS to BigQuery or do queries directly against data in the GCS bucket.
A (Correct answer) – You could either create a GCP account for auditor ACL object access or a signed URL depending on if they need to have a GCP account or not. Since the requirement is to “allow access for external auditors to view”, hence signed URL is the right choice
B – Does not meet the “for long-term access” requirement.
D – It works but for the “for long-term access” storage consideration, Cloud Storage is a better choice over BigQuery.
References:
Comments are closed, but trackbacks and pingbacks are open.