Task 3.4: Monitoring and logging.

• AA threshold alerting policy: CPU utilization above 85% for 10 minutes, notifying an email channel

  Correct

  A threshold condition with a retest window fires only when the value stays above the threshold for that long, and the channel delivers the email.

• BAn uptime check on each VM's HTTP port, with an alerting policy that fires on failed checks

  Incorrect

  The requirement is sustained CPU load, which this does not measure.

• CA Cloud Monitoring dashboard with a CPU utilization chart and a threshold line drawn at 85%

  Incorrect

  A dashboard shows the data but sends no notification when the line is crossed.

• DA log-based metric that counts CPU log entries from the VMs, with an alert when it exceeds 85

  Incorrect

  CPU utilization is already a metric; VMs do not write a log entry per CPU measurement to count.

An alerting policy pairs a condition with notification channels. The duration setting is what separates a sustained problem from a spike.

• ACreate a sink on the organization with --include-children and a filter for audit logs, routing to the dataset

  Correct

  An aggregated sink at the organization routes matching logs from every child project, including new ones.

• BCreate a sink in each existing project that routes audit logs to the dataset

  Incorrect

  Project sinks cover only today's projects; every new project would need its own sink.

• CGrant the security team Logs Viewer on the organization and query logs in the Logs Explorer

  Incorrect

  Viewing logs in place does not copy them to BigQuery for SQL analysis.

• DGrant the sink's writer identity permission to write to the BigQuery dataset

  Correct

  The sink writes with its own service identity, which needs write access to the destination before logs arrive.

• EIncrease the retention of each project's _Default log bucket to 10 years

  Incorrect

  This changes nothing about where the logs end up; they would still be spread across projects.

Aggregated sinks gather logs from a whole organization or folder. Like any sink, they write as a service identity that must be granted access to the destination.

• ATurn on VPC Flow Logs for every subnet from which users reach the bucket's objects

  Incorrect

  These do not record which identity read which object.

• BEnable Admin Activity audit logs for Cloud Storage in the project's audit configuration

  Incorrect

  Admin Activity logs are always written and cannot be turned off; they record configuration changes, not object reads.

• CEnable Data Access audit logs of type DATA_READ for the Cloud Storage service

  Correct

  Data Access audit logs, which record reads of data, are disabled by default for Cloud Storage and must be enabled.

• DCreate a log-based metric that counts storage.objects.get entries in the _Default bucket

  Incorrect

  Without Data Access logs there are no read entries in Cloud Logging to work with.

Admin Activity logs are always on. Data Access logs can be high volume, so most services leave them off until you enable the log types you need.

• AInstall the Ops Agent on the VMs, with a logging receiver for the application files

  Correct

  The Ops Agent collects guest metrics such as memory and disk usage, and its logging receivers send log files to Cloud Logging.

• BEnable VPC Flow Logs on the subnet and build charts from the flow log fields

  Incorrect

  These carry no memory or disk usage from inside the guest.

• CTurn on Data Access audit logs for Compute Engine in the project's audit configuration

  Incorrect

  Audit logs record API calls made to Compute Engine, not what happens inside the guest operating system.

• DCreate log-based metrics for memory use from the text in each VM's serial port output

  Incorrect

  Serial port output is not a reliable source of memory metrics, and it does not ship the application log files.

Metrics from the hypervisor cannot see inside the guest. The Ops Agent runs in the VM and sends both guest metrics and logs.

• AError Reporting

  Incorrect

  Error Reporting groups errors and exceptions; slow requests that succeed do not appear there.

• BUptime checks

  Incorrect

  It gives no breakdown of where the time goes across the four services.

• CCloud Profiler

  Incorrect

  It does not show how a single request moves through the four services.

• DCloud Trace

  Correct

  Cloud Trace records the latency of each step of a request across services, so you can see where the time is spent.

Distributed tracing breaks one request into spans per service, which shows where the latency of a request across several services is added.

• ACloud Asset Inventory

  Incorrect

  Asset Inventory tracks resources, not events and health.

• BCloud Hub in the console

  Correct

  Cloud Hub centralizes active events, health data, capacity and other operational insights for projects and App Hub applications.

• CThe Logs Explorer

  Incorrect

  The Logs Explorer shows log entries, not a combined operations view.

• DThe Billing Reports page

  Incorrect

  Billing reports show costs, not health or incidents.

Cloud Hub is the operations front page that correlates events, alerts and capacity across a project or application.

• Aresource.type="gce_instance" AND severity>=ERROR

  Correct

  The query restricts the resource type to VMs and the severity to ERROR and above.

• Bgce_instance ERROR

  Incorrect

  Bare words search text anywhere in entries instead of filtering fields.

• CSELECT * FROM logs WHERE type = 'vm' AND level = 'error'

  Incorrect

  The Logs Explorer uses the Logging query language, not this SQL.

• Dresource.type="k8s_cluster" AND severity=ERROR

  Incorrect

  This selects GKE cluster logs and only exact ERROR entries.

Filter on indexed fields such as resource.type and severity to find relevant entries quickly.

• AprotoPayload.authenticationInfo.principalEmail

  Correct

  The authenticationInfo of an audit log entry identifies the principal that made the request.

• Bresource.type

  Incorrect

  The resource type says what kind of resource the entry is about, not who made the call.

• CprotoPayload.methodName

  Incorrect

  The method name shows which operation was called, not who called it.

• Dresource.labels.project_id

  Incorrect

  This identifies the project of the resource, not the caller.

Audit log entries carry the caller's identity in authenticationInfo, which answers the question of who did what.

• ATwo email channels, one read by the function

  Incorrect

  Parsing email is a fragile way to trigger automation.

• BAn SMS channel and an email channel

  Incorrect

  Neither channel triggers code.

• CA log sink from the alert's logs to BigQuery

  Incorrect

  Sinks route logs; they are not alert notification channels.

• DPub/Sub for the automation, plus an email channel

  Correct

  Pub/Sub channels let code act on notifications, while email informs people.

Choose channels by who acts: people get email or chat, programs get Pub/Sub or webhooks.

• AAn alerting policy on CPU utilization

  Incorrect

  Alerts notify on conditions; they are not for ad-hoc charts.

• BA new custom dashboard with one chart

  Incorrect

  This works but is the dashboard you wanted to avoid.

• CMetrics Explorer in Cloud Monitoring

  Correct

  Metrics Explorer builds temporary charts to visualize metrics without a dashboard.

• DThe Logs Explorer filtered to the VMs

  Incorrect

  Logs show entries, not CPU utilization time series.

Use Metrics Explorer for quick questions and dashboards for views you keep.