Google Professional Cloud Database Engineer Question 62
Select 3Google Cloud PlatformYour organization uses Google Cloud's managed services, including Cloud SQL and BigQuery. The security team has requested that you ensure proper auditing policies are in place to monitor access to sensitive data and identify potential insider threats. Which actions should you take to meet the auditing requirements?
- A
Enable Cloud Audit Logs for 'Admin Activity' and 'Data Access' for the Cloud SQL and BigQuery services.
- B
Configure custom logging sinks to export audit logs to a central logging repository.
- C
Disable 'Data Access' logs to reduce costs, as they are optional for compliance.
- D
Review and enable VPC Flow Logs for network-layer auditing of Cloud SQL and BigQuery.
- E
Grant fine-grained IAM roles to ensure only authorized users can access audit logs.
Show answer and explanation
Correct answers: A, B, E
Explanation
Proper auditing of managed services like Cloud SQL and BigQuery requires enabling Cloud Audit Logs for both administrative and data-related activities, exporting logs for centralized analysis, and ensuring secure access to those logs. Disabling key log types or relying on unrelated tools like VPC Flow Logs does not meet auditing requirements for managed services.
- A. Correct.
Correct: Enabling Cloud Audit Logs for 'Admin Activity' and 'Data Access' is essential for monitoring administrative and data-related actions on resources like Cloud SQL and BigQuery.
- B. Correct.
Correct: Custom logging sinks allow you to export logs to a centralized repository, such as Cloud Storage or BigQuery, for long-term storage, analysis, or compliance reporting.
- C. Incorrect.
Incorrect: Disabling 'Data Access' logs reduces visibility into who accessed sensitive data, which is counterproductive for auditing sensitive services like Cloud SQL and BigQuery.
- D. Incorrect.
Incorrect: VPC Flow Logs are useful for network-layer monitoring but do not provide auditing for access to managed services like Cloud SQL and BigQuery.
- E. Correct.
Correct: Granting fine-grained IAM roles ensures that only authorized personnel can access or manage audit logs, which is critical for maintaining log integrity and security.