Practice Test 2 | Google Cloud Certified Professional Cloud Security Engineer | Dumps | Mock Test
A company has a GCP Organization with multiple Folders and Projects. You have been tasked with collecting the audit logs from every Project into a specified Cloud Storage Bucket for compliance purposes.
How can you achieve this following best practice of the least privilege? Choose TWO.
A. Create an aggregated sink using the Cloud Logging API.
B. Create an aggregated sink using the Cloud console.
C. Assign the Logging Admin IAM role to yourself.
D. Assign the Owner IAM role to yourself.
E. Assign the Logging Configuration Writer role to yourself.
Answer: A and E
- Option A is CORRECT. Aggregated log sinks can only be created via the Cloud Logging API or gcloud command-line tool.
- Option B is incorrect. Aggregated log sinks can only be created via the Cloud Logging API or gcloud command-line tool.
- Option C is incorrect. The Admin role has more permissions than what is needed to create a Sink.
- Option D is incorrect. The Owner role has more permissions than what is needed to create a Sink.
- Option E is CORRECT. The Logging Configuration Writer role has the required permissions to create a Sink.
Reference:
Comments are closed, but trackbacks and pingbacks are open.