A city IT lead wants one IAM boundary and one search scope for all recreation-booking logs across environments. Which Logging construct is the unit that provides that management shape?
Select an answer to reveal the explanation.
Short Explanation
A log group is the binder: IAM on the group covers the pages inside, search can target the whole binder, and moving the binder moves the logs. Organize by app or environment there.
Full Explanation
A log group is the Logging management unit: a logical container in a compartment that holds logs, carries IAM for everything inside, and moves with its logs when you relocate the group. For a city IT lead who wants one IAM boundary and one search scope across recreation-booking environments, organizing logs into (or searching across) log groups gives that shape—policy attaches to the group, and search can target the group or broader compartment scope as needed.
A single metric alarm pendingDuration setting only delays when a Monitoring alarm fires; it is not a Logging IAM or search container. An OCIR image tag shared by microservices versions container images; it does not group log objects or define Logging IAM. Selecting a Vault virtual private vault type governs how secrets are isolated, not how application or service logs are organized for search and policy.
Exam caveat: logs inherit the group’s compartment and move with the group—plan group boundaries by app or environment so IAM and retention intent stay clear when tenancy layout changes. Operational check: place recreation-booking service and custom logs in the intended log group, attach IAM at group scope, run a Logging Search scoped to that group, and confirm both environments’ relevant logs appear without opening unrelated tenancy noise.