Google Professional Cloud Database Engineer Question 63
Select 3Google Cloud PlatformYour organization uses Google Cloud's managed database services, including Cloud SQL and Firestore. You are tasked with ensuring that all database access and administration activities are logged for compliance purposes. Which actions should you take to assess and configure auditing policies for these managed services?
- A
Verify that Cloud Audit Logs are enabled for the project and include Admin Activity and Data Access logs.
- B
Enable the 'Enable Logging' option directly within the Cloud SQL instance settings.
- C
Review IAM roles assigned to users to ensure they have sufficient permissions to view and access audit logs in Cloud Logging.
- D
Configure a custom audit logging solution by deploying a logging agent directly on the underlying database servers.
- E
Set up log sinks in Cloud Logging to export audit logs to a secure storage location like Cloud Storage, BigQuery, or Pub/Sub for long-term retention.
Show answer and explanation
Correct answers: A, C, E
Explanation
To assess auditing policies for managed database services like Cloud SQL and Firestore, you must ensure that Cloud Audit Logs are enabled to capture relevant activities, verify that IAM roles allow proper access to these logs, and configure log sinks for secure and long-term storage. These steps are essential for meeting compliance requirements and maintaining an effective auditing strategy. Options 2 and 4 are incorrect because they involve unsupported or unnecessary configurations for managed services.
- A. Correct.
Cloud Audit Logs must be enabled to capture Admin Activity and Data Access logs for managed services like Cloud SQL and Firestore. This is a critical step for auditing and compliance.
- B. Incorrect.
There is no 'Enable Logging' option within Cloud SQL instance settings. Logging is managed via Cloud Audit Logs at the project level.
- C. Correct.
Reviewing IAM roles ensures that appropriate users can view and manage audit logs in Cloud Logging, which is necessary for effective auditing.
- D. Incorrect.
Managed services like Cloud SQL do not allow direct deployment of logging agents on their underlying infrastructure. Instead, auditing is handled through Cloud Audit Logs.
- E. Correct.
Setting up log sinks allows you to export and retain audit logs in secure, centralized locations for compliance and analysis purposes.