To ingest Cloud NAT logs for workloads in a designated folder while minimizing integration complexity, what is the correct configuration?

To ingest Cloud NAT logs for workloads in a designated folder while minimizing integration complexity, what is the correct configuration?

• A. Create a custom filter to export folder-level Cloud NAT logs.
• B. Create custom filters per project to export Cloud NAT logs.
• C. Configure an aggregated log sink at folder level and route Cloud NAT logs to Pub/Sub; enable the Pub/Sub connector for SecOps.
• D. Aggregated log sink at org level to Cloud Storage with Cloud Storage connector.

Answer: (C)

Centralize the logs by creating an aggregated log sink at the folder level and route Cloud NAT logs to a Pub/Sub topic, then enable the SecOps Pub/Sub connector. This approach captures Cloud NAT activity from every project within that folder in one place, reducing the need for per-project filters or multiple sinks. Routing to Pub/Sub provides a real-time stream that SecOps can readily consume, and the built-in Pub/Sub connector makes it straightforward to feed those logs into the security workflow with minimal setup. Using folder-level filters alone or per-project filters would add configuration and maintenance overhead, and sending to Cloud Storage would require extra steps to bring the data into SecOps and isn’t as immediate for streaming detections.

Centralize the logs by creating an aggregated log sink at the folder level and route Cloud NAT logs to a Pub/Sub topic, then enable the SecOps Pub/Sub connector. This approach captures Cloud NAT activity from every project within that folder in one place, reducing the need for per-project filters or multiple sinks. Routing to Pub/Sub provides a real-time stream that SecOps can readily consume, and the built-in Pub/Sub connector makes it straightforward to feed those logs into the security workflow with minimal setup. Using folder-level filters alone or per-project filters would add configuration and maintenance overhead, and sending to Cloud Storage would require extra steps to bring the data into SecOps and isn’t as immediate for streaming detections.