Centralized Log Management and Visibility in Google Cloud Organization

PCSE By islever Editorial Last updated

Configuring logging, monitoring, and detection. Defining the resource hierarchy.

Short answer

B Create one log sink at the organization level including all child resources, route to a SIEM via Pub/Sub, and grant the Viewer role at the organization level to allow the security team to view the environment's configuration.

Question

Your company's Google Cloud organization has about 200 projects and 1,500 virtual machines. There is no uniform strategy for logs and events management, which reduces visibility for your security operations team. You need to design a logs management solution that provides visibility and allows the security team to view the environment's configuration.
What should you do?
    1. Create a dedicated log sink for each project that is in scope. 2. Use a BigQuery dataset with time partitioning enabled as a destination of the log sinks. 3. Deploy alerts based on log metrics in every project. 4. Grant the role "Monitoring Viewer" to the security operations team in each project.
    1. Create one log sink at the organization level that includes all the child resources. 2. Use as destination a Pub/Sub topic to ingest the logs into the security information and event. management (SIEM) on-premises, and ensure that the right team can access the SIEM. 3. Grant the Viewer role at organization level to the security operations team.
    Correct Answer
    1. Enable network logs and data access logs for all resources in the "Production" folder. 2. Do not create log sinks to avoid unnecessary costs and latency. 3. Grant the roles "Logs Viewer" and "Browser" at project level to the security operations team.
    1. Create one sink for the "Production" folder that includes child resources and one sink for the logs ingested at the organization level that excludes child resources. 2. As destination, use a log bucket with a minimum retention period of 90 days in a project that can be accessed by the security team. 3. Grant the security operations team the role of Security Reviewer at organization level.

Key Takeaways

The main trap is confusing 'Security Reviewer' with 'Viewer'. Security Reviewer only sees security findings, while Organization Viewer is required to see the full resource hierarchy and configuration metadata.

This question tests designing a centralized logging strategy for a large Google Cloud organization. The correct solution involves an organization-level log sink and granting Organization Viewer permissions to ensure both log visibility and configuration access.

Common mistake: Candidates often choose Option D because they focus on log retention (90 days) and forget that Security Reviewer lacks the broad read access to resource configurations needed for general visibility. They may also hesitate on B due to the mention of an on-premises SIEM, overlooking that it represents the intended destination for centralized analysis.

Expert Analysis

The scenario requires a centralized logs management solution for an organization with 200 projects and 1,500 VMs to improve visibility and configuration viewing. The key constraint is the lack of a uniform strategy, implying the need for a scalable, single-pane-of-glass approach.

Option B proposes creating a single log sink at the organization level that includes all child resources. This centralizes ingestion. It then routes these logs to a Pub/Sub topic for a SIEM. While on-premises SIEM integration might seem like an extra step, it directly addresses the "visibility" requirement by feeding a dedicated security tool. Crucially, it grants the Viewer role at the organization level. In Google Cloud, the Organization Viewer role allows users to view the resource hierarchy and metadata (configuration) across all projects, which satisfies the requirement to "view the environment's configuration."

Option A suggests creating sinks per project and using BigQuery. This is operationally burdensome for 200 projects and doesn't inherently provide a unified configuration view without complex queries. Granting Monitoring Viewer does not grant access to resource configurations.

Option C suggests enabling logs but not creating sinks. Without a sink, logs remain in the default bucket with limited retention and no external visibility or SIEM integration, failing the "management solution" requirement.

Option D suggests creating sinks for folders/organization and using a log bucket with 90-day retention. While log buckets are good for storage, granting the Security Reviewer role is incorrect. Security Reviewer provides access to security findings and audit logs but does not grant broad access to view the entire resource hierarchy/configuration in the same way Organization Viewer does. Furthermore, relying solely on log buckets for real-time visibility is less effective than streaming to a SIEM.

The debate in comments often centers on whether B is too broad or requires external tools. However, compared to D, B correctly identifies the scope (Organization level) and the necessary permission set (Viewer for config visibility) combined with a robust ingestion method (SIEM). Option D's use of Security Reviewer limits visibility to security-specific data, not general environment configuration, and managing multiple sinks/folders is less efficient than one org-level sink.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When asked for a solution that spans many projects, always look for 'Organization' or 'Folder' level controls rather than Project-level ones. Additionally, distinguish between roles that grant access to logs versus resources. If the goal includes viewing the 'environment's configuration' or resource hierarchy, you typically need a broader role like Organization Viewer or Folder Viewer, not just Security-related roles.

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. ArizonaClassics 👍 2
    B. 1. Create one log sink at the organization level that includes all the child resources. 2. Use as destination a Pub/Sub topic to ingest the logs into the security information and event management (SIEM) on-premises, and ensure that the right team can access the SIEM.
  2. Andrei_Z 👍 2 Answered B
    It is B because you need a SIEM to actually analyse the configurations of the environments
  3. BPzen 👍 1 Answered B
    D. Revised for a No-Folder Scenario: Create a single organization-level log sink: Include all child resources (projects) to centralize logging for the entire organization. Configure log filters: If you want to scope the logs (e.g., for "production" projects only), use labels or other identifiers on projects to filter relevant logs into the sink. Destination: Use a log bucket in a dedicated project accessible to the security team. Ensure the log bucket has a minimum retention period of 90 days (or longer if required). Grant Access: Assign the Security Reviewer role to the security operations team at the organization level. This role provides read access to logs across all resources in the organization.
  4. zanhsieh 👍 1 Answered B
    B. A: No. Granting monitoring.viewer to security team doesn't help to see the log since log to BQ. C: No. How does the security team to view logs if no log sink created? This option means no log streaming in. D: No. "90 days retention period" and "Security Reviewer" are not the question asked for.
  5. b6f53d8 👍 1 Answered D
    Can not be B because of" Grant the Viewer role at organization level to the security operations team. This role is too broad
Show 6 more comments
  1. a190d62 👍 1 Answered B
    B https://github.com/GoogleCloudPlatform/community/blob/master/archived/exporting-security-data-to-your-siem/index.md
  2. b6f53d8 👍 1
    For sure not A, but I'm not sure B, because it required external SIEM, in my opinion D is the best option
  3. K1SMM 👍 1
    B makes sense cuz viewer role permits view environments configuration
  4. b6f53d8 👍 1 Answered D
    B required external on prem SIEM it is not recommended solution
  5. pfilourenco 👍 1 Answered B
    B makes sense
  6. cyberpunk21 👍 1 Answered B
    B is good

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

← Back to PCSE Study Guide