Exam Professional Cloud DevOps Engineer topic 1 question 38 discussion

looks like it is B. https://medium.com/google-cloud/fluentd-filter-plugin-for-google-cloud-data-loss-prevention-api-42bbb1308e76

Im not pretty sure but Ans B Prevent them form leaking to Stackdriver logging A: Incorrect, Leaking to Stackdriver B: Correct, not leaking to Stackdriver & fluentD C: Incorrect, Leaking D: If we removed why we need to create a filter matching there will not be logs with userinfo?

Why not D? Use fluentd filter to remove logs with userinfo and export existing logs for review?

option b

A suggests creating a basic log filter and configuring a log export to Cloud Storage, but it does not address preventing the PII entries from leaking to Stackdriver Logging. By creating only a basic log filter, the PII data would still be accessible within Stackdriver Logging.

B. Use a Fluentd filter plugin with the Stackdriver Agent to remove log entries containing userinfo, and then copy the entries to a Cloud Storage bucket. By using Fluentd filter plugin, you can remove log entries that contain PII information and configure it to send to a designated cloud storage bucket. This way you prevent the logs that contain PII from leaking to Stackdriver Logging, and have them stored in a secure location for later review.

All A,C and D are leaking to stackdriver. So the ans has to be B

Ans: B Exam passed and taken on 19/12/2022, 50/50 from this dump without buying the full access and looking for 'devops' word here: https://www.examtopics.com/discussions/google/1/

will go with B

Option B: https://cloud.google.com/logging/docs/agent/logging/configuration. Custom defined log entries has this structure "[TAG_NAME]+Payload+timestamp+Severity+labels". Here "Userinfo" is the TAG_NAME. Fluentd filter plugins used to filter out logs based on TAG_NAME. finally this could be stored in Cloud storage.

Answer is B

B is a poor answer IMHO because it seems to include a manual task of copying the PII data to the bucket at some later date (cron job or personal intervention, ugly either way). https://cloud.google.com/logging/docs/routing/overview makes it quite clear that this should be taken care by routing and the exclusion filter which would imply that C is the correct answer. "Cloud logging" is only one of the possible sink choices.

Ans B https://medium.com/google-cloud/fluentd-filter-plugin-for-google-cloud-data-loss-prevention-api-42bbb1308e76

Agree with B

A question is about capture logs entries in a secure location for later review, not removing the log sensitive data before store then in a secure location. so answer is A

B https://medium.com/google-cloud/fluentd-filter-plugin-for-google-cloud-data-loss-prevention-api-42bbb1308e76

B. filter_record_transformer to be exact.