Google Associate Cloud Engineer Question 330
Single answerGoogle Cloud PlatformYou are a Google Cloud Engineer responsible for ensuring compliance and security within your organization's cloud infrastructure. You need to configure audit logs for your Google Cloud project to monitor access to sensitive data. Which type of audit logs should you configure to track 'read' operations on your resources?
- A
Admin Activity logs
- B
Data Access logs
- C
System Event logs
- D
Policy Denied logs
Show answer and explanation
Correct answer: B
Explanation
To monitor 'read' operations on your Google Cloud resources, you need to configure Data Access logs. These logs are specifically designed to track access to data, allowing you to audit who accessed sensitive information and ensure compliance with your organization's security policies.
- A. Incorrect.
Admin Activity logs record administrative 'write' operations that modify the state or configuration of resources.
- B. Correct.
Data Access logs record 'read' operations and other operations where the resource state is not changed. This includes accessing data stored in Google Cloud services.
- C. Incorrect.
System Event logs capture Google Cloud system events, such as when a VM is started or stopped, but do not specifically track 'read' operations.
- D. Incorrect.
Policy Denied logs record requests that are denied due to organization policies, and do not track 'read' operations.