Medium1 markMultiple Choice
Domain 5.3: Viewing audit logsCloud LoggingLog SinksComplianceCloud Storage

GCP ACE · Question 50 · Domain 5.3: Viewing audit logs

Your compliance department requires that all Data Access audit logs be retained for 3 years. Cloud Logging only retains these logs for 30 days by default.

Which TWO actions should you take to meet this compliance requirement? (Select TWO)

Answer options:

A.

Create a Log Sink in Cloud Logging.

B.

Set the destination of the Log Sink to a Cloud Storage bucket.

C.

Upgrade your Google Cloud support plan to Premium to extend log retention.

D.

Set the destination of the Log Sink to Cloud Memorystore.

E.

Take a daily snapshot of the Cloud Logging database.

How to approach this question

Understand how to export logs for long-term retention in GCP.

Full Answer

Create a Log Sink in Cloud Logging., Set the destination of the Log Sink to a Cloud Storage bucket.
To retain logs beyond the default retention period of Cloud Logging, you must export them. You do this by creating a Log Sink (a router). The sink uses a filter to select the logs you want (Data Access logs) and routes them to a supported destination. For long-term, 3-year compliance retention, a Cloud Storage bucket (often using the Archive storage class) is the most cost-effective and standard destination.

Common mistakes

Thinking you can just change a setting to keep logs for 3 years in Cloud Logging. While custom retention is possible, it is very expensive compared to exporting to Cloud Storage.

Practice the full GCP Associate Cloud Engineer Practice Exam 7

50 questions · hints · full answers · grading

More questions from this exam