Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An organization processes financial transactions in Google Cloud and stores application logs in a custom Cloud Logging bucket. The JSON payloads contain general debugging data alongside sensitive customer identifiers (jsonPayload.user.ssn and jsonPayload.user.credit_card).
Security requirements dictate that:
Which solution should the security team implement to satisfy these requirements?
Upgrade the log bucket to use Log Analytics and create SQL views with column-masking functions to restrict access to sensitive fields.
Configure field-level access control on the log bucket to restrict jsonPayload.user.ssn and jsonPayload.user.credit_card, grant developers standard log viewing roles, and grant the compliance team the roles/logging.fieldAccessor role.
Create a Log Router sink with an exclusion filter matching jsonPayload.user.ssn and jsonPayload.user.credit_card to drop the fields during routing.
Define two granular log views on the log bucket—one with a filter excluding entries containing sensitive fields for developers, and one without filter restrictions for the compliance team.
Upgrade the log bucket to use Log Analytics and create SQL views with column-masking functions to restrict access to sensitive fields.
Configure field-level access control on the log bucket to restrict jsonPayload.user.ssn and jsonPayload.user.credit_card, grant developers standard log viewing roles, and grant the compliance team the roles/logging.fieldAccessor role.
Field-level access control in Cloud Logging is a granular security mechanism that allows administrators to hide specific fields inside a LogEntry (such as nested paths in jsonPayload, protoPayload, or labels) while keeping the rest of the log entry visible to authorized users.
StudyCerts
StudyCerts--restricted-fields="jsonPayload.user.ssn,jsonPayload.user.credit_card" on the target log bucket, Cloud Logging automatically redacts and denies direct queries to those exact leaf paths for unauthorized users while still returning the parent log entries.roles/logging.viewer or roles/logging.viewAccessor) can query and inspect the unmasked payload fields in Logs Explorer. Only members of the compliance team granted the Log Field Accessor (roles/logging.fieldAccessor) role can view the restricted fields.roles/logging.fieldAccessor query logs, global searches bypass restricted field content, and returned LogEntry records omit the restricted values.Unlike log views or sink exclusion filters—which operate at the granularity of entire log entries—field-level access control allows development teams to maintain full context and operational visibility for debugging without exposing PII.
Create a Log Router sink with an exclusion filter matching jsonPayload.user.ssn and jsonPayload.user.credit_card to drop the fields during routing.
Define two granular log views on the log bucket—one with a filter excluding entries containing sensitive fields for developers, and one without filter restrictions for the compliance team.