Associate Cloud EngineerDemo

By Google · Question Mode

QuestionQ1

Configuring access and security

An auditor for your organization wants to review how data in Google Cloud is being used. The auditor is most interested in seeing who has accessed data stored in Cloud Storage buckets. You need to help the auditor get access to the data they need. What should you do?

  • A Turn on Data Access Logs for the buckets they want to audit, and then build a query in the log viewer that filters on Cloud Storage.
  • B Assign the appropriate permissions, and then create a Data Studio report on Admin Activity Audit Logs.
  • C Assign the appropriate permissions, and then use Cloud Monitoring to review metrics.
  • D Use the export logs API to provide the Admin Activity Audit Logs in the format they want.
Explanation

Cloud Storage Data Access audit logs record read (and write) operations performed on objects and buckets, including who performed them, whereas Admin Activity audit logs only record configuration and metadata changes and do not track data access events. Because Data Access audit logs (other than BigQuery) are disabled by default due to their volume, they must be explicitly enabled for the buckets that need to be audited. Once enabled, the resulting log entries can be viewed and filtered in the Logs Explorer (log viewer) by filtering on the Cloud Storage resource type, giving the auditor the ability to see who accessed the data in those buckets.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!