Google Professional Cloud Database Engineer Question 64
Select 3Google Cloud PlatformYou are a Cloud Database Engineer responsible for implementing auditing policies for a Cloud SQL instance hosting a critical application. The organization requires all administrative actions, login attempts, and high-privilege queries to be logged for compliance purposes. Which steps should you take to meet these requirements?
- A
Enable Cloud Audit Logs for the Cloud SQL instance and configure it to log ADMIN_READ and DATA_WRITE events.
- B
Enable the 'Database Activity Insights' feature in Cloud SQL and link it with Cloud Monitoring.
- C
Configure Cloud SQL Insights to capture all SQL queries and link it to BigQuery for long-term storage.
- D
Enable 'Data Access' logs for Cloud Audit Logs and configure it to log DATA_READ and DATA_WRITE events.
- E
Set up a Pub/Sub topic to capture Cloud Audit Log events and export them to a Cloud Storage bucket.
Show answer and explanation
Correct answers: A, D, E
Explanation
To meet the compliance requirements, you need to enable Cloud Audit Logs for both administrative and data access events (ADMIN_READ, DATA_READ, and DATA_WRITE). Additionally, setting up a mechanism to export and retain these logs, such as using Pub/Sub and Cloud Storage, ensures long-term retention for audits. Features like 'Database Activity Insights' and 'Cloud SQL Insights' are designed for performance monitoring and optimization rather than auditing.
- A. Correct.
Correct. Enabling Cloud Audit Logs for ADMIN_READ and DATA_WRITE events ensures that administrative actions and data modifications are logged, which is a compliance requirement.
- B. Incorrect.
Incorrect. 'Database Activity Insights' is a performance monitoring tool and does not provide auditing logs for administrative actions or login attempts.
- C. Incorrect.
Incorrect. Cloud SQL Insights is used for performance diagnostics and query optimization. It does not meet the requirement of logging administrative actions and login attempts.
- D. Correct.
Correct. Enabling Data Access logs for DATA_READ and DATA_WRITE ensures that data access and modification queries are logged, which satisfies part of the compliance requirements.
- E. Correct.
Correct. Exporting Cloud Audit Logs to Cloud Storage through Pub/Sub ensures long-term retention of audit logs, which is often a compliance requirement.