Google Cloud Professional Cloud Security Engineer Practice Exam

Which logging export strategy meets the requirement for a unified log view in SIEM from development projects?

1. Create a Pub/Sub topic for logging

2. Create a Cloud Storage sink with specific properties

3. Enable Stackdriver logging for all resources

4. Use Log Router to export logs

The correct answer is: Create a Cloud Storage sink with specific properties

The choice of creating a Cloud Storage sink with specific properties aligns well with the requirement for a unified log view in a Security Information and Event Management (SIEM) system pertaining to development projects. This approach allows for centralized storage of logs, which can be critical for maintaining a holistic view of activities within development environments. By exporting logs to Cloud Storage, all logs can be streamed into a single location, facilitating easier access and management when integrating with SIEM tools. This centralized access is crucial for security analysts, as it enables efficient correlation of logs from various sources, including development tools, services, and applications. Proper configuration and structuring of the Cloud Storage sink can also ensure that logs are compiled in a format that the SIEM can readily ingest and analyze. While other options may provide useful functionalities, they do not specifically cater to the need for a unified log view in a way that is as straightforward or effective as the Cloud Storage sink. For instance, using a Pub/Sub topic for logging may introduce complexity by requiring additional handling for subscribers and might not provide the centralized view needed for SIEM utilization. Enabling Stackdriver logging enhances visibility but may not offer the same level of unified access, as logs may still be dispersed across different resource types. Utilizing Log Router