Hard1 markMultiple Choice
Subtask 4.1: Technical ProcessesCloud LoggingLog SinksCloud StorageCompliance

GCP PCA · Question 42 · Technical Processes

Your company generates massive amounts of application logs across hundreds of Compute Engine VMs. The security team needs to retain all logs for 7 years for compliance. The operations team needs to query the last 30 days of logs in real-time to troubleshoot production issues. How should you configure Cloud Logging to meet BOTH requirements cost-effectively? (Select TWO)

Answer options:

A.

Set the default Cloud Logging bucket retention period to 7 years.

B.

Create a Log Sink to export all logs to a Cloud Storage bucket with an Archive storage class.

C.

Create a Log Sink to export all logs to a BigQuery dataset.

D.

Retain the default 30-day retention policy on the _Default Cloud Logging bucket.

E.

Install a third-party SIEM agent on all VMs to bypass Cloud Logging entirely.

How to approach this question

Separate the requirements: 30-day real-time access (keep in Cloud Logging) and 7-year cheap retention (export to Cloud Storage).

Full Answer

B,D
Cloud Logging uses a router/sink architecture. By default, logs are routed to the `_Default` log bucket, which has a 30-day retention period. This satisfies the ops team's need for real-time troubleshooting. To satisfy the security team's 7-year compliance requirement cost-effectively, you create a Log Sink that matches all logs and exports them to a Cloud Storage bucket configured with the Archive storage class.

Common mistakes

Trying to use one tool for both jobs (Option A or C). Architectural best practice dictates using the right tool for the right timeframe to optimize costs.

Practice the full GCP Professional Cloud Architect Practice Exam 7

50 questions · hints · full answers · grading

More questions from this exam