Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
A production microservice running on Cloud Run begins throwing intermittent HTTP 403 Forbidden runtime exceptions when attempting to integrate with downstream Google Cloud storage services. A recent security update introduced both VPC Service Controls perimeters and revised identity policies across service accounts. You need to isolate whether the integration failures originate from service account IAM permission gaps or VPC Service Controls perimeter restrictions, while identifying the exact caller identity and requested method.
Which troubleshooting strategy should you use to isolate the root cause?
Cloud Audit Logs capture detailed system and caller interactions across Google Cloud services by recording structured JSON payloads inside protopayload_auditlog. When external service integration failures or permission denials occur, Google Cloud records the full context of the invocation—including the principal, requested method, target resource, and specific denial reasons—into cloudaudit_googleapis_com_policy and related audit log streams.
StudyCerts
StudyCertsprotopayload_auditlog.authenticationInfo.principalEmail reveals the exact runtime service account identity initiating the API request, while protopayload_auditlog.methodName identifies the exact API method invoked.metadataJson.violationReason and checking whether a SERVICE_NOT_ALLOWED_FROM_VPC or perimeter boundary block occurred allows engineers to definitively differentiate between VPC Service Controls policy blocks and native IAM permission denied errors.resource.labels.service specifies which protected API was accessed, allowing immediate correlation with the application's external integration logic.metadataJson.dryRun).Directly inspecting structured audit log payloads provides unambiguous root-cause isolation without modifying running container code or guessing between IAM permission errors and VPC-SC perimeter denials.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.