PCSE Question 10

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  A. 1. Export logs to a Cloud Pub/Sub topic with folders/NONPROD parent and includeChildren property set to True in a dedicated SIEM project. 2. Subscribe SIEM to the topic. Other options: B — export from billing account will not cover all necessary projects, includeChildren=False will not collect everything. C — requires manual configuration in each project, not centralized. D — unsafe (public bucket) and not centralized. A — correct and recommended method for this task.

• Chose A1

  A. Correct: This is the most effective and scalable solution. By creating a log sink at the folder level (folders/NONPROD) with includeChildren set to True, you capture logs from all projects within that folder and any subfolders. Exporting to a Cloud Pub/Sub topic is the best practice for real-time streaming to a SIEM (Security Information and Event Management) system, which can then subscribe to the topic to get a unified, real-time log view. This method is also efficient because it only requires a single sink to be configured.

• Chose C1

  I'm still confused why the right answer is A. I choose C even though will put operationally heavy and error-prone. What I understand is the team only needs "development" projects, and the "development" project is under NONPROD folder along with other projects ("test" and "pre-production"). All these projects use the same billing account. But the goal is only send dev project logs to the SIEM, not including test or pre-production projects. Option C is give me guarantee that only dev projects logs are being sent to Pub/Sub in a dedicated SIEM project. then the topic is consume by SIEM