To ingest Cloud NAT logs for workloads in a designated folder while minimizing integration complexity, what is the correct configuration?

• A. Create a custom filter to export folder-level Cloud NAT logs.
• B. Create custom filters per project to export Cloud NAT logs.
• C. Configure an aggregated log sink at folder level and route Cloud NAT logs to Pub/Sub; enable the Pub/Sub connector for SecOps.
• D. Aggregated log sink at org level to Cloud Storage with Cloud Storage connector.

Answer: (C)

Centralize the logs by creating an aggregated log sink at the folder level and route Cloud NAT logs to a Pub/Sub topic, then enable the SecOps Pub/Sub connector. This approach captures Cloud NAT activity from every project within that folder in one place, reducing the need for per-project filters or multiple sinks. Routing to Pub/Sub provides a real-time stream that SecOps can readily consume, and the built-in Pub/Sub connector makes it straightforward to feed those logs into the security workflow with minimal setup. Using folder-level filters alone or per-project filters would add configuration and maintenance overhead, and sending to Cloud Storage would require extra steps to bring the data into SecOps and isn’t as immediate for streaming detections.