Exam Associate Cloud Engineer topic 1 question 244 discussion

Option C is the most appropriate choice for capturing audit and data access logs from a Bigtable instance and sending them to your SIEM system. 1) Enabling Data Read, Data Write, and Admin Read logs for the Bigtable instance ensures that you capture the relevant operations, including read and write operations, as well as administrative reads, in the audit logs. 2) Creating a Pub/Sub topic as a Cloud Logging sink destination allows you to export the logs from Cloud Logging to Pub/Sub. This is a common approach for sending logs to external systems, including SIEMs. 3) Adding your SIEM as a subscriber to the Pub/Sub topic ensures that the logs are forwarded to your SIEM system, allowing you to monitor and analyze them for security and compliance purposes. NB:A Cloud Logging sink destination is a configuration that specifies where logs collected by Google Cloud's Cloud Logging service should be sent or exported. It allows you to control the destination of logs generated by various Google Cloud services, such as Compute Engine, Cloud Storage, BigQuery, and more.

https://cloud.google.com/bigtable/docs/audit-logging#permission-type

https://cloud.google.com/bigtable/docs/audit-logging

Its C!

C is the correct answer, as it helps you to read and write

C is correct.

https://cloud.google.com/bigtable/docs/audit-logging#available-logs B: Admin write logs are already enabled by default

Data Access audit logs—except for BigQuery—are disabled by default and you need to enable them

Enabling Admin Write logs for the Bigtable instance in Cloud Logging will capture administrative write actions on the Bigtable instance. This includes any configuration changes and metadata reads related to the Bigtable instance. Creating a Cloud Functions instance and configuring it to export logs from Cloud Logging to your SIEM allows you to take the captured logs and route them to your SIEM system in a format that your SIEM can understand. Cloud Functions can act as a serverless function to process and forward the logs to your SIEM using an appropriate method, such as sending them via an API or message queue.