Google Professional Cloud Security Engineer Question 451
Select 3Google Cloud PlatformYour organization uses Google Cloud and wants to monitor all data access activities for a sensitive BigQuery dataset. To satisfy compliance requirements, you need to ensure that the data access logs are properly enabled and will capture all the required information. Which steps should you take to configure and analyze Google Cloud Audit Logs for this purpose?
- A
Enable the Data Access logs for BigQuery in the Admin Activity audit logs.
- B
Ensure the IAM role 'roles/logging.viewer' is granted to the security team for analyzing logs.
- C
Enable Data Access logs for BigQuery in the appropriate audit log configuration.
- D
Configure a sink to export the Data Access logs to a Cloud Storage bucket for long-term analysis.
- E
Grant the 'roles/bigquery.admin' role to the security team to access the logs.
Show answer and explanation
Correct answers: B, C, D
Explanation
To meet compliance requirements for monitoring data access activities in BigQuery, you must explicitly enable Data Access logs for BigQuery, as they are not enabled by default. The security team should have appropriate IAM roles, such as 'roles/logging.viewer,' to analyze the logs. To retain logs for longer periods or for detailed analysis, exporting them to Cloud Storage using a log sink is recommended. Admin Activity logs are not relevant in this scenario, and granting additional permissions like 'roles/bigquery.admin' is unnecessary for log analysis.
- A. Incorrect.
Incorrect: Admin Activity logs are always enabled and do not include Data Access logs. Data Access logs need to be separately enabled in the audit log configuration.
- B. Correct.
Correct: The 'roles/logging.viewer' role allows the security team to view logs in Cloud Logging, which is necessary for analyzing the audit logs.
- C. Correct.
Correct: Data Access logs for services like BigQuery need to be explicitly enabled in the Google Cloud audit log configuration to capture access events.
- D. Correct.
Correct: Exporting logs to a Cloud Storage bucket via a sink is a best practice for long-term retention and detailed analysis of logs.
- E. Incorrect.
Incorrect: Granting the 'roles/bigquery.admin' role to the security team is unnecessary for accessing logs. Proper logging permissions like 'roles/logging.viewer' are sufficient.