How to Route Logs from the Default Log Bucket Efficiently?

PCSE By islever Editorial Last updated

Short answer

D Edit the default log sink and change its destination to the newly created log bucket to preserve catch-all routing efficiently.

Question

You have just created a new log bucket to replace the _Default log bucket. You want to route all log entries that are currently routed to the _Default log bucket to this new log bucket, in the most efficient manner. What should you do?
  1. Create exclusion filters for the _Default sink to prevent it from receiving new logs. Create a user-defined sink, and select the new log bucket as the sink destination.
  2. Disable the _Default sink. Create a user-defined sink and select the new log bucket as the sink destination.
  3. Create a user-defined sink with inclusion filters copied from the _Default sink. Select the new log bucket as the sink destination.
  4. Edit the _Default sink, and select the new log bucket as the sink destination. Correct Answer

Key Takeaways

Tests understanding of system-managed sinks versus user-defined sinks, with the common trap being overcomplicating the process by recreating filters or disabling the default sink.

Changing the destination of the default log routing requires modifying the existing system sink rather than creating duplicates. This guide establishes why editing the default sink is the most efficient configuration method.

Common mistake: Option C is frequently selected because candidates assume they must manually copy filters to a new user-defined sink, overlooking that the default sink already captures all unmatched logs.

Expert Analysis

Why the Answer Is Correct

The _Default sink operates as a system-managed catch-all that automatically routes every log entry not matched by other sinks. By directly editing this sink and swapping its destination to your newly created bucket, you preserve the inclusive routing behavior without disrupting ingestion. This single-action update eliminates redundant configurations and aligns with Google Cloud best practices for resource management.

Why the Other Options Are Wrong

Creating exclusion filters or disabling the sink would break the automatic catch-all mechanism, causing logs to drop or require manual re-routing. Copying filters to a new user-defined sink adds unnecessary administrative overhead and increases the risk of misconfiguration. The exam prioritizes operational efficiency, making direct destination updates the only viable path.

Community Comment Notes

Learners who verified the console confirmed that sink destinations can be updated directly without recreating resources. Several users noted that AI-generated advice sometimes suggests overly complex workarounds, while practical testing shows the built-in edit function handles the transition seamlessly. As one commenter observed, "D is most efficient and is possible to do" after checking the live environment.

Official Reference

https://cloud.google.com/logging/docs/buckets#manage_buckets

This link opens the official vendor documentation in a new tab.

Exam Strategy

When configuring managed Google Cloud resources, always look for native edit capabilities before assuming you need to create or destroy components. Exam questions testing efficiency heavily favor modifying existing system-managed objects over building custom alternatives from scratch.

Frequently Asked Questions

Why shouldn't I disable the default sink before routing logs elsewhere?

Disabling it stops all unmatched logs from being captured, breaking automatic retention. Editing the destination maintains continuous ingestion.

Can I copy the default sink filters to a new user-defined sink instead?

Yes, but it adds unnecessary complexity since the default sink already acts as a catch-all. Direct editing saves time and reduces configuration errors.

More PCSE FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. brpjp 👍 4
    D is correct answer, you can change the log destination for existing sink without creating new sink. as per Gemini.
  2. nah99 👍 2 Answered D
    D is most efficient and is possible to do. I just checked in GCP b/c people using AI as their source in this forum is a major red flag
  3. Pime13 👍 1 Answered D
    https://cloud.google.com/logging/docs/buckets#manage_buckets
  4. koo_kai 👍 2 Answered D
    I think it's D
  5. yokoyan 👍 1 Answered C
    I think it's C.
Show 1 more comment
  1. 3fd692e 👍 1 Answered D
    D is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

← Back to PCSE Study Guide