An enterprise is designing a compliance and auditing architecture across its Google Cloud organization while optimizing Cloud Logging storage and ingestion costs. The security operations team has established the following requirements: Track all administrative configuration modifications and IAM changes. Track automated Google Cloud system actions that modify resource configurations. Monitor read and write interactions with sensitive user-provided data. Grant compliance auditors the minimum required IAM role to view all generated audit categories within the _Default log bucket. Which combination of audit log configurations and IAM roles should you implement?

Rely on the default configuration for Admin Activity and System Event logs, explicitly enable Data Access audit logs for the relevant services, and grant auditors the Private Logs Viewer (`roles/logging.privateLogViewer`) role.: ### What Cloud Audit Logs and Private Logs Viewer Are **Cloud Audit Logs** provide visibility into actions executed across Google Cloud environments by answering "Who did what, where, and when?". **Admin Activity** logs capture configuration and metadata writes (`ADMIN_WRITE`), while **System Event** logs record automated actions taken by Google Cloud systems that alter resource states. **Data Access** audit logs capture metadata reads (`ADMIN_READ`), data reads (`DATA_READ`), and data writes (`DATA_WRITE`). The **Private Logs Viewer** (`roles/logging.privateLogViewer`) role provides permission to read all log types including sensitive Data Access logs in the `_Default` log bucket. ### How it meets the requirements - **Administrative and System Modifications:** Admin Activity and System Event logs are enabled by default and cannot be disabled, capturing all configuration writes and automated system adjustments without additional overhead or cost. - **Sensitive Data Interactions:** Data Access audit logs are disabled by default (except for BigQuery) to prevent high-volume log ingestion costs. Explicitly enabling Data Access logs (`DATA_READ` and `DATA_WRITE`) only for services hosting sensitive data fulfills the auditing requirement while controlling storage spend. - **Auditor Access:** Assigning `roles/logging.privateLogViewer` grants auditors access to view Admin Activity, System Event, Policy Denied, and Data Access audit logs located in the `_Default` bucket. ### Key advantages and capabilities - **Cost Optimization:** Explicitly enabling Data Access logs only where necessary prevents runaway ingestion fees from routine data operations across all services. - **Comprehensive Compliance:** Captures both user-initiated operations and automated platform actions. - **Least-Privilege Security:** Protects sensitive data access records by restricting them to identities holding private log inspection privileges. ### Why this is optimal This architecture accurately leverages default log generation for control plane events, targets high-volume Data Access logging selectively to optimize costs, and uses the correct IAM role needed to inspect private data logs in the default storage bucket.

StudyCerts

Configure Cloud Audit Logs And Iam Roles | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Configure Cloud Audit Logs And Iam Roles

Section: Audits (including logs)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is designing a compliance and auditing architecture across its Google Cloud organization while optimizing Cloud Logging storage and ingestion costs. The security operations team has established the following requirements:

Track all administrative configuration modifications and IAM changes.
Track automated Google Cloud system actions that modify resource configurations.
Monitor read and write interactions with sensitive user-provided data.
Grant compliance auditors the minimum required IAM role to view all generated audit categories within the _Default log bucket.

Which combination of audit log configurations and IAM roles should you implement?

Rely on default configuration for Data Access logs, explicitly enable Policy Denied logs, and grant auditors the Private Logs Viewer (roles/logging.privateLogViewer) role.

Explicitly enable Admin Activity and System Event audit logs in the audit configuration, disable Data Access logs, and grant auditors the Logs Viewer (roles/logging.viewer) role.

Enable Data Access audit logs across all services by default, create exclusion filters on Admin Activity logs to reduce costs, and grant auditors the Logs Viewer (roles/logging.viewer) role.

Rely on the default configuration for Admin Activity and System Event logs, explicitly enable Data Access audit logs for the relevant services, and grant auditors the Private Logs Viewer (roles/logging.privateLogViewer) role.

Professional Cloud Architect

Configure Cloud Audit Logs And Iam Roles

Related questions