Google Associate Cloud Engineer Question 332
Select 3Google Cloud PlatformYou are a Google Cloud Engineer responsible for setting up audit logging for a new project in Google Cloud Platform. The requirement is to ensure that all admin activity and data access events are logged for all services in the project. Which steps should you take to achieve this?
- A
Enable Admin Activity logs and Data Access logs for all services using Google Cloud Console.
- B
Navigate to IAM & Admin > Audit Logs and enable all available logs for the required services.
- C
Use gcloud command-line tool to enable audit logs for the project.
- D
Create a custom role with permissions to view audit logs and assign it to necessary users.
- E
Ensure that the appropriate permissions are set to allow viewing and analysis of the audit logs.
Show answer and explanation
Correct answers: A, B, E
Explanation
To configure audit logs effectively, you need to ensure that both Admin Activity and Data Access logs are enabled for all services. This is best managed through IAM & Admin settings in the Google Cloud Console. Additionally, setting appropriate permissions allows users to view and analyze logs, which is crucial for monitoring and compliance.
- A. Correct.
Admin Activity logs are enabled by default, but Data Access logs must be explicitly enabled for each service using Google Cloud Console.
- B. Correct.
IAM & Admin > Audit Logs is where you can manage the audit logging configurations for each service.
- C. Incorrect.
The gcloud command-line tool does not directly enable audit logs. It is primarily used for managing resources and configurations.
- D. Incorrect.
Creating a custom role is unrelated to enabling audit logs. It is more concerned with permissions management.
- E. Correct.
Permissions such as 'logging.viewer' or 'logging.admin' are needed to view and analyze audit logs, ensuring that users have access to the logs.