Google Professional Cloud Security Engineer Question 453
Select 2Google Cloud PlatformYour organization is required to monitor all access to sensitive data stored in Google Cloud Storage for compliance purposes. You have been tasked with ensuring that audit logs capture all read and write access to these buckets. What steps should you take to configure Google Cloud Audit Logs for this purpose?
- A
Enable the Data Access logs for the relevant Google Cloud Storage buckets in the Cloud Logging configuration.
- B
Grant the 'logs.viewer' role to the service account responsible for accessing audit logs.
- C
Ensure that Data Access logs are enabled in the Google Cloud project's IAM settings.
- D
Create a sink in Cloud Logging to export Data Access logs to a separate storage bucket for long-term retention.
- E
Enable the Admin Activity logs for the project to capture all administrative actions related to the buckets.
Show answer and explanation
Correct answers: A, D
Explanation
To meet compliance requirements for monitoring access to Google Cloud Storage, Data Access logs must be explicitly enabled because they are not enabled by default. Additionally, a logging sink should be created to export logs for long-term retention or analysis, as required by compliance standards. Admin Activity logs, while useful for tracking administrative changes, do not capture data access events and are not relevant in this scenario. Similarly, granting the 'logs.viewer' role does not configure or enable logs but only provides access to view them.
- A. Correct.
Correct: Data Access logs must be explicitly enabled for Google Cloud services like Cloud Storage, as they are not enabled by default. This ensures all read and write access events are captured.
- B. Incorrect.
Incorrect: Granting the 'logs.viewer' role allows a user or service account to view logs but does not configure or enable logging itself.
- C. Incorrect.
Incorrect: Data Access logs are enabled at the service level (e.g., Cloud Storage), not directly in the IAM settings of the project.
- D. Correct.
Correct: Creating a logging sink ensures that logs, including Data Access logs, can be exported for long-term storage or further analysis, which is often required for compliance.
- E. Incorrect.
Incorrect: Admin Activity logs track administrative actions like bucket creation or permissions changes but do not capture data read/write events. They are enabled by default and do not need additional configuration.