Google Cloud Professional Cloud Security Engineer Practice Exam

For real-time audit log exports in Google Cloud, which mechanism should be used?

1. Cloud Pub/Sub

2. Direct exports to BigQuery

3. Logs Viewer

4. Cloud SQL

The correct answer is: Cloud Pub/Sub

Using Cloud Pub/Sub for real-time audit log exports in Google Cloud provides a highly efficient and scalable mechanism for handling log data as events occur. Cloud Pub/Sub is a messaging service that allows for the asynchronous, decoupled transmission of data between different services in Google Cloud. When audit logs are generated, they can be pushed to Cloud Pub/Sub, allowing subscribers to process these logs in real-time. This setup encourages flexibility, enabling various services to subscribe to the logs, whether for further analysis, alerting, or other processing tasks. This real-time capability is essential for organizations that require immediate insights or reactions based on audit log information. Other available options, while useful in different contexts, do not provide the same level of immediacy or versatility for real-time scenarios. For instance, direct exports to BigQuery are more suited for batch processing and analysis rather than for immediate monitoring or alerting. Logs Viewer allows for inspection of logs in a user interface but does not facilitate real-time export. Cloud SQL is a relational database service that would not be suitable for direct log exports in real-time either. Thus, the integration of Cloud Pub/Sub in the architecture allows for a dynamic and responsive logging system, vital for effective security monitoring and compliance auditing.