Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ288

Ensuring data protection

A team in your organization gathers logs in an on-premises security information and event management (SIEM) system. You need to supply the SIEM with a subset of Google Cloud logs while minimizing the risk of data exposure in the cloud environment. What should you do?

  • A Create a new BigQuery dataset. Stream all logs to this dataset. Provide the on-premises SIEM system access to the data in BigQuery by using workload identity federation and let the SIEM team filter for the relevant log data.
  • B Define a log view for the relevant logs. Provide access to the log view to a principal from your on-premises identity provider by using workforce identity federation.
  • C Create a log sink for the relevant logs. Send the logs to Pub/Sub. Retrieve the logs from Pub/Sub and push the logs to the SIEM by using Dataflow.
  • D Filter for the relevant logs. Store the logs in a Cloud Storage bucket. Grant the service account access to the bucket. Provide the service account key to the SIEM team.
Explanation

A log sink with an inclusion filter routes only the required log entries to Pub/Sub. Pub/Sub is the recommended Cloud Logging integration path for third-party software, and a Dataflow pipeline can retrieve those filtered entries and deliver them to the on-premises SIEM. This limits the exported data and avoids broad dataset access or distributing a long-lived service-account key.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!