You have a three-node Bigtable instance storing PII. You must log all read/write operations and metadata/config reads to your SIEM. What should you enable and how should you export the logs?

The correct approach is to enable comprehensive audit logging and export via a Cloud Logging sink. Bigtable audit logs (Data Read, Data Write, Admin Read) capture the required operations and metadata access. Cloud Logging sinks efficiently export these logs to destinations like Pub/Sub. Pub/Sub is an ideal intermediary for SIEM integration, as SIEM systems can subscribe to the topic to receive logs in near real-time. Incorrect options: Cloud Monitoring tracks metrics, not detailed audit logs of read/write operations or metadata changes. Enabling only Admin Write logs is insufficient as it misses data read, data write, and admin read operations. A Cloud Function could export logs, but a Logging Sink is a more managed and scalable solution for continuous export. Bigtable is a managed service; you cannot install agents like Ops Agent on its nodes. Dataflow is for data processing, not the primary mechanism for exporting audit logs.