Associate Cloud EngineerDemo

By Google · Question Mode

QuestionQ13

Configuring access and security

You are storing sensitive information in a Cloud Storage bucket. For legal reasons, you need to be able to record all requests that read any of the stored data. What should you do to meet this requirement?

  • A Enable the Identity Aware Proxy API on the project.
  • B Scan the bucket using the Data Loss Prevention API.
  • C Allow only a single Service Account access to read the data.
  • D Enable Data Access audit logs for the Cloud Storage API.
Explanation

Google Cloud's Data Access audit logs capture API operations that read data or configuration, including object-level reads in Cloud Storage (the DATA_READ log type). These logs are disabled by default because of their volume, so they must be explicitly enabled for the Cloud Storage API to ensure every read request against the bucket's objects is recorded, satisfying the legal requirement to track all data access. The other options either restrict access (without logging), scan for sensitive content, or manage authentication proxying — none of which produce a record of every read request.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!