QuestionQ336

Designing for security and compliance

A company runs an application across multiple Compute Engine instances and generates 1 TB of logs each day. For compliance, the logs must be retained for at least two years. They must remain available for active querying for 30 days; afterward, they only need to be retained for audit purposes. You want to implement a compliant, cost-minimizing storage solution that follows Google-recommended practices. What should you do?

  • A
    1. Install a Cloud Logging agent on all instances. 2. Create a sink to export logs into a regional Cloud Storage bucket. 3. Create an Object Lifecycle rule to move files into a Coldline Cloud Storage bucket after one month. 4. Configure a retention policy at the bucket level using bucket lock.
  • B
    1. Write a daily cron job, running on all instances, that uploads logs into a Cloud Storage bucket. 2. Create a sink to export logs into a regional Cloud Storage bucket. 3. Create an Object Lifecycle rule to move files into a Coldline Cloud Storage bucket after one month.
  • C
    1. Install a Cloud Logging agent on all instances. 2. Create a sink to export logs into a partitioned BigQuery table. 3. Set a time_partitioning_expiration of 30 days.
  • D
    1. Create a daily cron job, running on all instances, that uploads logs into a partitioned BigQuery table. 2. Set a time_partitioning_expiration of 30 days.
Explanation

Cloud Logging can collect the instance logs and route them through a sink to Cloud Storage. Cloud Storage Object Lifecycle Management can transition older objects to the lower-cost Coldline class after the 30-day active-query period. A bucket retention policy, locked with Bucket Lock, makes objects undeletable or unreplaceable until the configured retention period has elapsed, supporting the two-year compliance requirement.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!