Question

Your security team needs to retain and analyze all Cloud Audit Logs from a production project for at least two years, and they want to run SQL queries against the log data to investigate access patterns. By default, admin activity logs are only retained for 400 days in Cloud Logging. What should you configure to meet these requirements?

Accepted Answer

Create a log sink in Cloud Logging that exports the audit logs to a BigQuery dataset.

Answer

Increase the retention period of the _Default log bucket to 730 days.

Answer

Create a log-based metric for the audit logs and build a Cloud Monitoring dashboard.

Answer

Enable Data Access audit logs and download the entries manually each month.