Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
An organization processes financial transactions in Google Cloud and stores application logs in a custom Cloud Logging bucket. The JSON payloads contain general debugging data alongside sensitive customer identifiers (jsonPayload.user.ssn and jsonPayload.user.credit_card).
Security requirements dictate that:
Which solution should the security team implement to satisfy these requirements?
Field-level access control in Cloud Logging is a granular security mechanism that allows administrators to hide specific fields inside a LogEntry (such as nested paths in jsonPayload, protoPayload, or labels) while keeping the rest of the log entry visible to authorized users.
StudyCerts
StudyCerts--restricted-fields="jsonPayload.user.ssn,jsonPayload.user.credit_card" on the target log bucket, Cloud Logging automatically redacts and denies direct queries to those exact leaf paths for unauthorized users while still returning the parent log entries.roles/logging.viewer or roles/logging.viewAccessor) can query and inspect the unmasked payload fields in Logs Explorer. Only members of the compliance team granted the Log Field Accessor (roles/logging.fieldAccessor) role can view the restricted fields.roles/logging.fieldAccessor query logs, global searches bypass restricted field content, and returned LogEntry records omit the restricted values.Unlike log views or sink exclusion filters—which operate at the granularity of entire log entries—field-level access control allows development teams to maintain full context and operational visibility for debugging without exposing PII.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.