GCP Professional Cloud DevOps Engineer Practice Question 10: Logging Ingestion Cost Exclusions

Cloud Logging bills primarily on the volume of log data ingested into log buckets, so the lever that actually moves the bill is ingesting less. The _Default sink can be modified, and adding exclusion filters to it stops matching entries from being routed to the _Default bucket, so they are neither stored nor charged. High-volume, low-value entries (successful load balancer requests and DEBUG lines nobody reads) are the textbook candidates, and an exclusion can be applied partially (sampling a percentage) if the team wants to keep a representative sample. The compliance requirement is unaffected, because Admin Activity audit logs are routed by the _Required sink to the _Required bucket, which retains them for 400 days at no charge.

Option B misidentifies the cost driver. The first 30 days of retention in the _Default bucket is included in the ingestion price, so shortening retention from 30 to 7 days saves nothing while throwing away recent logs the team does still query. Retention charges only start to matter beyond the default period.

Option C adds cost rather than removing it. The entries are still ingested and billed on the way through, the Cloud Storage copies incur their own storage charges, and the team loses Logs Explorer and log-based metrics over the data it archives.

Option D is not possible: the _Required sink cannot be modified or deleted. It exists precisely so that Admin Activity, System Event, and Access Transparency logs are always captured, and since those logs are not charged for ingestion, removing them would not have reduced the bill anyway.

References: Exclude log entries from a sink; Google Cloud Observability pricing