Exam Professional Cloud DevOps Engineer topic 1 question 38 discussion

looks like it is B. https://medium.com/google-cloud/fluentd-filter-plugin-for-google-cloud-data-loss-prevention-api-42bbb1308e76

Im not pretty sure but Ans B Prevent them form leaking to Stackdriver logging A: Incorrect, Leaking to Stackdriver B: Correct, not leaking to Stackdriver & fluentD C: Incorrect, Leaking D: If we removed why we need to create a filter matching there will not be logs with userinfo?

It should be C. 1. Sink (Include): Create a high-priority sink to export logs matching userinfo to a private Cloud Storage bucket. 2. Exclusion Filter (Exclude): Create an exclusion filter to drop logs matching userinfo from all Cloud Logging storage buckets.

Why not D? Use fluentd filter to remove logs with userinfo and export existing logs for review?

option b

A suggests creating a basic log filter and configuring a log export to Cloud Storage, but it does not address preventing the PII entries from leaking to Stackdriver Logging. By creating only a basic log filter, the PII data would still be accessible within Stackdriver Logging.

B. Use a Fluentd filter plugin with the Stackdriver Agent to remove log entries containing userinfo, and then copy the entries to a Cloud Storage bucket. By using Fluentd filter plugin, you can remove log entries that contain PII information and configure it to send to a designated cloud storage bucket. This way you prevent the logs that contain PII from leaking to Stackdriver Logging, and have them stored in a secure location for later review.

All A,C and D are leaking to stackdriver. So the ans has to be B

Ans: B Exam passed and taken on 19/12/2022, 50/50 from this dump without buying the full access and looking for 'devops' word here: https://www.examtopics.com/discussions/google/1/

will go with B

Option B: https://cloud.google.com/logging/docs/agent/logging/configuration. Custom defined log entries has this structure "[TAG_NAME]+Payload+timestamp+Severity+labels". Here "Userinfo" is the TAG_NAME. Fluentd filter plugins used to filter out logs based on TAG_NAME. finally this could be stored in Cloud storage.

Answer is B

B is a poor answer IMHO because it seems to include a manual task of copying the PII data to the bucket at some later date (cron job or personal intervention, ugly either way). https://cloud.google.com/logging/docs/routing/overview makes it quite clear that this should be taken care by routing and the exclusion filter which would imply that C is the correct answer. "Cloud logging" is only one of the possible sink choices.

Ans B https://medium.com/google-cloud/fluentd-filter-plugin-for-google-cloud-data-loss-prevention-api-42bbb1308e76

Agree with B

A question is about capture logs entries in a secure location for later review, not removing the log sensitive data before store then in a secure location. so answer is A

B https://medium.com/google-cloud/fluentd-filter-plugin-for-google-cloud-data-loss-prevention-api-42bbb1308e76