Centralizing Production Folder Logs with an Aggregated Log Sink

PCDOE By islever Editorial Last updated

Managing and analyzing logs. Instrumenting and collecting telemetry. Managing metrics, dashboards, and alerts.

Short answer

D Create an aggregated log sink on the production folder and use a Cloud Logging bucket as the destination to centralize production-folder logs for native alerting and near-real-time log analysis.

Question

Your company has a Google Cloud resource hierarchy with folders for production, test, and development. Your cyber security team needs to review your company's Google Cloud security posture to accelerate security issue identification and resolution. You need to centralize the logs generated by Google Cloud services from all projects only inside your production folder to allow for alerting and near-real time analysis. What should you do?
  1. Enable the Workflows API and route all the logs to Cloud Logging.
  2. Create a central Cloud Monitoring workspace and attach all related projects.
  3. Create an aggregated log sink associated with the production folder that uses a Pub/Sub topic as the destination.
  4. Create an aggregated log sink associated with the production folder that uses a Cloud Logging bucket as the destination. Correct Answer

Key Takeaways

The question tests the difference between a Cloud Logging bucket destination, which supports native log analytics and alerting, and a Pub/Sub destination, which only streams logs to a downstream consumer.

An aggregated log sink at the production folder can collect logs from every child project, and a Cloud Logging bucket destination provides immediate, queryable storage for log-based alerting and near-real-time analysis. This page explains why D is correct and why the Pub/Sub sink in C is the attractive distractor.

Common mistake: Choosing C because "near-real-time analysis" sounds like Pub/Sub streaming; Pub/Sub is useful only when a downstream SIEM or processing service is specified, while the question asks to centralize logs for alerting and analysis with no such consumer.

Expert Analysis

Why C is tempting

Option C is the answer many candidates reach for because it combines two real capabilities: a folder-level aggregated sink and Pub/Sub's streaming delivery. If the requirement had named a SIEM, a Cloud Function, or a third-party analytics platform, routing production-folder logs to Pub/Sub would be a natural design. One common argument is that security teams need to stream logs to a SIEM for near-real-time detection, and Pub/Sub is the documented transport for that pattern.

Where C stops being correct

The question does not name any downstream subscriber, SIEM, or processing service. It asks to centralize logs from all production-folder projects so the security team can perform alerting and near-real-time analysis. A Pub/Sub topic is a messaging channel, not a queryable log repository; by itself it does not provide log search, Log Analytics, or log-based alerting. Option D, an aggregated sink on the production folder with a Cloud Logging bucket as the destination, keeps the logs in Cloud Logging, where they are immediately available for querying, log-based alerts, and Log Analytics across the centralized set. It also matches the "only inside your production folder" constraint because the sink is scoped to that folder and its child projects.

The bucket confusion

Some discussion warns that log sinks have hourly delays. That warning applies to Cloud Storage buckets, not Cloud Logging buckets. A Cloud Logging bucket destination is a native Logging resource and is available immediately; Cloud Storage is the archival destination. Option B monitors projects but does not centralize logs, and option A misuses Workflows. Therefore D is the clean, minimal answer.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When an item contrasts a Cloud Logging bucket with Pub/Sub, first identify whether the stem names a downstream consumer such as a SIEM, BigQuery, or Cloud Function. If it does, a Pub/Sub sink is plausible because it streams; if the stem only asks for centralized storage, querying, and alerting, favor the native Logging bucket. Also verify the sink scope—folder-level aggregated sinks capture child projects—and ignore Cloud Storage latency warnings that do not apply to Logging buckets.

Frequently Asked Questions

Does a folder-level aggregated log sink collect logs from projects below that folder?

Yes. An aggregated sink created on the production folder includes log entries from the folder itself and from all child folders and projects, so you do not need a sink per project.

Why not route the production-folder logs to Pub/Sub for near-real-time analysis?

Pub/Sub is a streaming transport, not a log analysis store. It is appropriate when a named subscriber such as a SIEM or Cloud Function consumes the stream; without one, a Cloud Logging bucket provides the native query and alerting path.

Is the hourly routing delay for Cloud Storage relevant to a Cloud Logging bucket destination?

No. The hourly processing warning applies to Cloud Storage buckets used for archival. Log entries routed to Cloud Logging buckets are available for querying and analysis without that archival delay.

More PCDOE FAQ →

Community Votes

D
70%
C
30%

70% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 23 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 23

  1. ReachTango73 👍 11
    D is correct as when you use buckets you can do log analysis
  2. alpha_canary 👍 4 Answered C
    It clearly mentions here that "Sinks to Cloud Storage are processed hourly while other destination types are processed in real time." https://cloud.google.com/logging/docs/export/configure_export_v2#:~:text=New%20log%20sinks%20to%20Cloud%20Storage%20buckets%20might%20take%20several%20hours%20to%20start%20routing%20logs.%20Sinks%20to%20Cloud%20Storage%20are%20processed%20hourly%20while%20other%20destination%20types%20are%20processed%20in%20real%20time. D is eliminated
  3. Andrei_Z 👍 4 Answered C
    I would vote C because from a security perspective it would be better to stream the logs to a SIEM or SOAR for near-real time analysis and alerting. A SIEM is not really mentioned here but streaming them to a bucket and analysing them from stackdriver would be nuts
  4. lelele2023 👍 4
    C is the answer: sink is the native feature of GCP to route logs and this excludes A and B. Also being asked to achieve near-real time analysis, and the pub-sub works better then a bucket.
  5. activist 👍 4
    Answer C seems to be correct. https://cloudplatform.googleblog.com/2015/06/Real-Time-Log-Streaming-and-Analysis-with-Google-Cloud-Platform-Logentries.html
Show 18 more comments
  1. mshafa 👍 4 Answered C
    C seems an to be correct.
  2. ccpmad 👍 3 Answered D
    it is D, why should we use pub/sub for logs? are we crazy?
  3. fixeres 👍 2
    This is correct, but you are mixing two things up. A Cloud Logging Bucket is not the same as a Cloud Storage Bucket. https://cloud.google.com/logging/docs/export/configure_export_v2 A Cloud Logging Bucket does process in real-time and is the preferred Option here.
  4. Feliphus 👍 2 Answered D
    I would choose C ans to export the logs to a SIEM product, but if we can use a Cloud Logging bucket as a central repository I prefer and the statement doesn't say anything about exportation.
  5. CAnalytics123 👍 2 Answered D
    D is correct
  6. fixeres 👍 1 Answered D
    So, after some research. The correct answer is D. There seems to be a lot of discussion, wether near-real time analysis is given or not. In Fact both C and D support near real-time analysis. https://cloud.google.com/logging/docs/export/using_exported_logs "Logs that you route to Cloud Logging buckets are available immediately." https://cloud.google.com/logging/docs/export/pubsub " Routed logs are generally available within seconds of their arrival to Logging, with 99% of logs available in less than 60 seconds." The main difference lays somewhere else. The question states that the logs are retrieved from different projects. And in fact for this use case Cloud Logging is the preffered option: https://cloud.google.com/logging/docs/export/configure_export_v2 Cloud Logging: " A log bucket can store logs that are received by multiple Google Cloud projects."
  7. mohan999 👍 1
    Many seem to getting confused with logging bucket and cloud storage buckets. Both are different things. Cloud storage is never an option for logs analysis but with custom logging bucket, you can analyze the logs and infact all logs that are seen in logs explorer are stored in default & required logging bucket. Coming to the Pub/Sub, it is messaging service & can be good option for near real time analysis when you are sending these logs to any other 3rd party tool like SIEM or Splunk analysis tool. You can't just analyze logs just from retrieving the logs from Pub/Sub topic. Unless there is another destination, Pub/Sub will be useless. In the question, it is not mentioned whether any 3rd part tool is being used, so D is correct option.
  8. gaurav517 👍 1 Answered D
    Option D: Aggregated log sink at production folder → Cloud Logging bucket ✅ Aggregated sink at folder level collects logs from all child projects ✅ Cloud Logging bucket provides centralized storage ✅ Supports log analytics and querying ✅ Can create log-based alerts on centralized logs ✅ Near-real-time log availability ✅ Native integration with Cloud Logging features ✅ Simpler setup than Pub/Sub routing ✅ Purpose-built for centralized log management
  9. manishk39 👍 1 Answered C
    Between options C and D, option C (Create an aggregated log sink associated with the production folder that uses a Pub/Sub topic as the destination) is the best choice for the requirement of "alerting and near-real-time analysis." This is because Pub/Sub can facilitate streaming of logs to other services like Cloud Functions, Cloud Run, or third-party services for immediate processing and alerting.
  10. BlackCoffee 👍 1 Answered C
    The correct answer is C. Create an aggregated log sink associated with the production folder that uses a Pub/Sub topic as the destination. D is incorrect: While a Cloud Logging bucket can store centralized logs, it is primarily optimized for storage, compliance, and historical analysis (using Log Analytics/SQL), rather than streaming log ingestion for instant, near-real-time alerting pipelines.
  11. Nkay17 👍 1
    Answer is C. Cloud Logging includes the capability for log archival in Google Cloud Storage and the ability to send logs to Google BigQuery. In addition, Cloud Logging also allows you to forward these logs to any custom endpoint including third party log management services for advanced and tailored log analytics via the near real-time streaming Google Cloud Pub/Sub API.
  12. YushiSato 👍 1
    There is a delay with the Cloud Storage Bucket, but no delay appears to occur with the Log Bucket. https://cloud.google.com/logging/docs/export/configure_export_v2 > New log sinks to Cloud Storage buckets might take several hours to start routing logs. Sinks to Cloud Storage are processed hourly while other destination types are processed in real time.
  13. filipemotta 👍 1 Answered D
    By creating an aggregated log sink at the folder level for production, you can collect logs from all projects within that folder. Using a Cloud Logging bucket as the destination simplifies management and enables straightforward integration with Cloud Monitoring and alerting tools for security analysis.
  14. surfer111 👍 1
    Customers would be very annoyed if they had to use an additional technology for something as simple as logs and analysis. Configuring pub/sub is foreign to a lot of orgs when they are used to tech like kafka. All you need is a sink to a Cloud Logging bucket. D
  15. alpha_canary 👍 1 Answered D
    https://cloud.google.com/logging/docs/export/using_exported_logs#:~:text=Logs%20that%20you%20route%20to%20Cloud%20Logging%20buckets%20are%20available%20immediately.
  16. Min3em 👍 1 Answered C
    D doesn't have the option to analyze and wont let you able to do the real time analysis! But pub/Sub does
  17. mshafa 👍 1
    Does it address near-real-time analysis?
  18. YushiSato 👍 1 Answered D
    I think D is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Mitigating Downstream Service Failures with Circuit Breakers

S-grade

Error Budget Exhausted: Should You Deploy an Urgent Customer Feature?

S-grade

Choosing a Latency SLO from Measured p90/p95 Performance

S-grade

SRE Postmortem Triggers: External Stakeholders and Data Loss

S-grade

Practice All PCDOE Questions

Access 75 questions with complete answers and detailed explanations.

View Full PCDOE Practice Test →

← Back to PCDOE Study Guide