GCP ACE Drill: Bigtable Security Logging - The Audit Logging Trade-off

The Architecture Drill (Simulated Question)

#

Scenario

#

Veridian Games, a rapidly expanding global gaming studio, stores personally identifiable player data (PII) in a Google Cloud Bigtable instance. This database currently runs on a 3-node cluster. To comply with internal security policies and external regulations, Veridian’s security team mandates capturing every read and write operation on the Bigtable instance — including configuration or metadata reads — and forwarding these logs automatically to their Security Information and Event Management (SIEM) system for real-time analysis and alerting.

The Requirement:

#

Ensure every Bigtable read/write action and metadata access is logged comprehensively and reliably exported into the SIEM system with minimal engineering maintenance and operational cost.

The Options

#

• A) Use Cloud Monitoring to create custom metric-based monitoring on the Bigtable instance, trigger alerts for any changes, and forward those via webhook endpoints to the SIEM.
• B) Enable Admin Write logs via Cloud Audit Logs for the Bigtable instance, then use Cloud Functions to export logs from Cloud Logging to the SIEM.
• C) Enable Data Read, Data Write, and Admin Read audit logs on the Bigtable instance, then create a Cloud Logging sink with a Pub/Sub topic as destination and subscribe the SIEM system to the topic.
• D) Install the Ops Agent on the Bigtable nodes, create a service account with Bigtable read permissions, and build a custom Dataflow pipeline on this service account to export logs to the SIEM.

Correct Answer

#

Option C.

The Architect’s Analysis

#

Correct Answer

#

Option C.

The Winning Logic

#

This approach fully enables Data Read, Data Write, and Admin Read audit logs, covering all accesses and metadata operations required by the security team. Exporting logs via a Cloud Logging sink to a Pub/Sub topic, where the SIEM is a subscriber, is the recommended best practice for near real-time streaming, scalability, and durability. It leverages Google’s managed audit log service, ensuring consistent, secure, and reliable capture of all Bigtable operations with minimal maintenance or custom tooling.

The Trap (Distractor Analysis)

#

• Why not A?
  Cloud Monitoring custom metrics do not capture granular read/write data operations, especially metadata reads, making it incomplete for audit requirements. Alerts cannot substitute full audit logs.
• Why not B?
  Enabling only Admin Write logs omits Data Read and Data Write operations, leaving gaps in compliance. Additional Cloud Functions add operational complexity and cost.
• Why not D?
  Ops Agent cannot be installed on Bigtable as a managed service. Creating custom Dataflow pipelines to poll data adds unnecessary maintenance burden, potential data latency, and increased costs.

The Architect Blueprint

#

Mermaid Flow Diagram illustrating audit log capture, export, and SIEM ingestion pipeline.

Diagram Note: User read/write operations generate audit logs in Cloud Logging, which are exported via a sink to Pub/Sub, then consumed by the SIEM for monitoring and alerting.

Real-World Application (Practitioner Insight)

#

Exam Rule

#

“For the exam, always enable Data Read, Data Write, and Admin Read audit logs and configure a Cloud Logging sink for exporting log data to downstream systems.”

Real World

#

“In production, relying on native audit logs with Pub/Sub export ensures compliance without adding brittle custom telemetry or unnecessary compute costs. This obeys the SRE principle of reducing toil and automating observability.”

Disclaimer

This is a study note based on simulated scenarios for the GCP Associate Cloud Engineer (ACE) exam. It is not an official question from Google Cloud.