Cloud Digital Leader Scaling with Google Cloud operations Practice Question
A financial services company is migrating its on-premises monitoring system to Google Cloud. They need to collect metrics, logs, and traces from multiple projects and provide a unified view for their operations team. Security requires that logs containing sensitive data be stored with additional encryption and access controls. Which combination of services should they use?
⚠ Common exam trap
Google Cloud often tests the misconception that the _Required and _Default buckets are sufficient for compliance, but they lack CMEK and granular access controls, which are essential for sensitive data handling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Monitoring, Cloud Logging, and Cloud Trace with a custom sink to a BigQuery dataset that uses CMEK.
The company needs to collect metrics, logs, and traces (requiring Cloud Monitoring, Cloud Logging, and Cloud Trace) and must store logs containing sensitive data with additional encryption and access controls. A custom sink to BigQuery with CMEK provides customer-managed encryption keys for the BigQuery dataset, and BigQuery's native access controls (IAM, row-level security) satisfy the requirement for additional access controls beyond the default Logging buckets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud Monitoring, Cloud Logging, and Cloud Trace with Logging's _Required and _Default buckets.
Why it's wrong here
The _Required and _Default log buckets are built-in storage locations managed by Google: _Required retains admin activity, data access, and system events, while _Default captures all other project logs. Neither bucket supports customer-managed encryption keys (CMEK), so logs remain encrypted with Google-managed keys, failing any compliance requirement that demands the customer control encryption. Additionally, these default buckets do not provide the BigQuery-based analytic querying or custom IAM controls that a dedicated sink can deliver.
- ✓
Cloud Monitoring, Cloud Logging, and Cloud Trace with a custom sink to a BigQuery dataset that uses CMEK.
Why this is correct
A custom log sink routes selected log entries to a user-controlled destination, here a BigQuery dataset encrypted with CMEK, enabling the customer to manage and rotate the encryption keys via Cloud KMS. Pairing this with Cloud Monitoring for resource metrics and Cloud Trace for distributed request spanning gives complete observability: logs, metrics, and traces are unified. The CMEK-protected BigQuery dataset also allows fine-grained IAM access control and retention management, satisfying both encryption and least-privilege requirements.
- ✗
Cloud Monitoring and Cloud Logging with Log Analytics.
Why it's wrong here
Log Analytics in Cloud Logging enables SQL-like querying over logs stored in log buckets, but this combination omits Cloud Trace entirely. Without Trace, you cannot capture latency data across microservices or correlate a request's span tree with log and metric signals, leaving performance troubleshooting and dependency analysis severely limited. Full observability requires all three pillars, so this option fails the requirement for distributed tracing.
- ✗
Cloud Monitoring, Cloud Logging, and Cloud Trace with Cloud Audit Logs.
Why it's wrong here
Cloud Audit Logs record admin activity, data access, and policy decisions made within Google Cloud, not the application-generated telemetry needed for workload observability. These audit logs are retained in Google-managed _Required buckets and do not support CMEK, so they do not meet the encryption-control requirement for sensitive log data. Merely adding Cloud Audit Logs—without a custom sink to CMEK-protected storage—leaves application logs and traces encrypted with keys the customer cannot manage.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
BigQuery
BigQuery is a fully managed, serverless data warehouse on Google Cloud that lets you run fast SQL queries on massive datasets without managing any infrastructure.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.