Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ165

Managing operations

Your organization uses Google Workspace, Google Cloud, and a third-party SIEM. You need to export events including user logins, successful logins, and failed logins to the SIEM. The logs must be ingested in real time or near real time. What should you do?

  • A Poll Cloud Logging for authentication events using the gcloud logging read tool. Forward the events to the SIEM.
  • B Configure Google Workspace to directly send logs to the API endpoint of the third-party SIEM.
  • C Create a Cloud Storage bucket as a sink for all logs. Configure the SIEM to periodically scan the bucket for new log files.
  • D Create a Cloud Logging sink to export relevant authentication logs to a Pub/Sub topic for SIEM subscription.
Explanation

A filtered Cloud Logging sink can route the relevant authentication log entries to a Pub/Sub topic, which a SIEM can subscribe to. Cloud Logging publishes routed entries to Pub/Sub as it receives them; entries are generally available within seconds, making this the appropriate near-real-time third-party integration method.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!