Discuss Google Professional Cloud DevOps Engineer Exam Topic 3 Question 77

Your organization stores all application logs from multiple Google Cloud projects in a central Cloud Logging project. Your security team wants to enforce a rule that each project team can only view their respective logs, and only the operations team can view all the logs. You need to design a solution that meets the security team's requirements, while minimizing costs. What should you do?

AExport logs to BigQuery tables for each project team. Grant project teams access to their tables. Grant logs writer access to the operations team in the central logging project.

BCreate log views for each project team, and only show each project team their application logs. Grant the operations team access to the _ Al Il-jogs View in the central logging project.

CGrant each project team access to the project _ Default view in the central logging project. Grant logging viewer access to the operations team in the central logging project.

DCreate Identity and Access Management (IAM) roles for each project team and restrict access to the _ Default log view in their individual Google Cloud project. Grant viewer access to the operations team in the central logging project.

Suggested Answer: B

Create log views for each project team, and only show each project team their application logs.Grant the operations team access to the _AllLogs View in the central logging project1.

This approach aligns with the Google Cloud's recommended methodologies for Professional Cloud DevOps Engineers1. Log views allow you to create and manage access control at a finer granularity for your logs. By creating a separate log view for each project team, you can ensure that they only have access to their respective logs. The operations team, on the other hand, can be granted access to the _AllLogs view in the central logging project, allowing them to view all logs as required.

This solution not only meets the security team's requirements but also minimizes costs as it leverages built-in features of Google Cloud's logging and does not require exporting logs to another service like BigQuery (as suggested in option A), which could incur additional costs1.

Get Premium Professional Cloud DevOps Engineer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

34 comments · newest first

Mirta 11 months ago

I think C is too permissive for project teams.

Desiree 11 months ago

D is a solid approach, IAM roles are powerful!

Pilar 11 months ago

Wait, can we really limit access like that? Sounds tricky.

Mitzie 11 months ago

I disagree, A seems more scalable for future projects.

Glenna 12 months ago

Option B sounds like the best choice for access control.

Rosalind 12 months ago

I vaguely recall that granting access to the _ Default view might not be secure enough. I think option C could expose logs unintentionally.

Rosio 1 year ago

I feel like option D might be overcomplicating things with IAM roles. I thought the simpler solutions were usually better, like using log views.

Junita 1 year ago

I think exporting logs to BigQuery like in option A could be costly, especially if we have a lot of logs. We practiced a similar question where cost was a big factor.

Lili 1 year ago

I remember we discussed log views in class, but I'm not entirely sure how they work in this context. Would option B really limit access effectively?

Taryn 1 year ago

Option A looks promising - exporting logs to BigQuery and granting access seems like a clean way to segregate the data. I'll double-check the pricing implications, but this could be a good solution.

Deandrea 1 year ago

Hmm, I'm a bit confused by the different log view options. I'll need to review the Google Cloud Logging documentation to understand the differences between the project-specific views and the central logging project.

Kimberlie 1 year ago

This seems like a straightforward access control problem. I'll carefully read through the options and think about the most efficient way to meet the security requirements while minimizing costs.

Ligia 1 year ago

I'm leaning towards Option D. Creating IAM roles for each project team and restricting access to their own logs seems like the most secure approach. The operations team can still have viewer access to the central project.

Terrilyn 1 year ago

Hmm, this looks like a tricky one. I'll need to think carefully about the different options and what they each allow an app builder to configure.

Tran 2 years ago

What do you mean, 'minimize costs'? I'm just going to choose the most secure option, which is D. Forget about the costs, this is a security exam!

Elly 2 years ago

Option A seems like a lot of work with the BigQuery tables. I'd go with the simpler solution of log views in Option B.

Erinn 2 years ago

↳ replying to Elly

Yeah, creating log views for each project team seems like the best option.

Tamesha 2 years ago

↳ replying to Elly

I agree, Option B with log views sounds simpler and more efficient.

Rebbecca 2 years ago

↳ replying to Elly

Option A seems like a lot of work with the BigQuery tables.

Rupert 2 years ago

↳ replying to Elly

Yeah, creating log views for each project team seems like the best option here.

Shasta 2 years ago

↳ replying to Elly

I agree, Option B with log views sounds simpler and more efficient.

Janna 2 years ago

↳ replying to Elly

Option A seems like a lot of work with the BigQuery tables.

Robt 2 years ago

I'm leaning towards option B, it seems like a good balance between security and accessibility.

Thora 2 years ago

I disagree, I believe option D is more secure and cost-effective.

Myra 2 years ago

Hmm, I'm not sure about Option C. Granting access to the default view doesn't seem like it would meet the security team's requirements.

Dalene 2 years ago

I think option A is the best solution.

Sheron 2 years ago

I think Option D is the way to go. Creating IAM roles and restricting access in the individual projects is a more secure approach.

Tommy 2 years ago

↳ replying to Sheron

Granting viewer access to the operations team in the central logging project is a smart move.

Buffy 2 years ago

↳ replying to Sheron

It's important to restrict access to the Default log view in each individual project.

Ashleigh 2 years ago

↳ replying to Sheron

I agree, creating IAM roles for each project team seems like the best way to control access.

Novella 2 years ago

↳ replying to Sheron

Option D is definitely the most secure choice.

Mitzie 2 years ago

Option B makes the most sense. Creating log views for each project team is a clean and efficient way to control access to the logs.

Bernadine 2 years ago

↳ replying to Mitzie

I agree, it's important to ensure that each team only has access to the logs they need.

Alona 2 years ago

↳ replying to Mitzie

Option B makes the most sense. Creating log views for each project team is a clean and efficient way to control access to the logs.

Google Professional Cloud DevOps Engineer Exam - Topic 3 Question 77 Discussion