Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use Log Explorer to filter logs by the Cloud Storage service and the 'data_access' log type.

  Why this is correct

  Using Log Explorer in the Google Cloud console lets you query and filter audit logs once they are enabled. By applying a filter for the Cloud Storage service and the 'data_access' log type, you can view object-level operations such as writes, deletes, and overwrites. This is the final step that makes the audit trail visible and actionable for compliance, but it requires Data Access logging to already be enabled in the IAM audit config.

• ✗

  Create a VPC Service Controls perimeter.

  Why it's wrong here

  A VPC Service Controls perimeter is a security mechanism that restricts data movement across a defined boundary, preventing exfiltration through context-based access policies. While it can block unauthorized copies of data, it does not generate an audit trail of individual object modifications or configuration changes. Therefore, it cannot satisfy the requirement to audit all actions that modify a Cloud Storage bucket; it is a preventive control, not a detective auditing control.

• ✗

  Enable Admin Activity audit logs for the Cloud Storage service.

  Why it's wrong here

  Admin Activity audit logs capture control-plane operations, such as creating a bucket, deleting a bucket, or changing IAM policies. They do not record data-plane actions like uploading, overwriting, or deleting individual objects within a bucket. Enabling Admin Activity for Cloud Storage would still leave a gap for object-level modifications, so it is not the correct approach for auditing all modification actions.

• ✗

  Assign the roles/logging.viewer role to the security team.

  Why it's wrong here

  Granting the roles/logging.viewer role to the security team gives them read-only access to view logs in Log Explorer and other Logging features, but it does not itself enable any audit logging. Audit log generation is determined by the IAM audit config at the project or organization level, independent of who has viewer permissions. Without first turning on Data Access audit logs for Cloud Storage, the security team would have no data_access entries to view, so this role assignment is a supplementary step rather than a solution for enabling auditing.

• ✓

  Enable Data Access audit logs for the Cloud Storage service in the project's IAM audit config.

  Why this is correct

  Enabling Data Access audit logs for Cloud Storage in the project's IAM audit config is the fundamental prerequisite for capturing object-level modifications. When the 'data_access' log type is enabled for the cloudstorage.googleapis.com service, Cloud Logging records DATA_READ and DATA_WRITE operations, including object creates, deletes, and overwrites. This configuration must be in place before Log Explorer can display the data needed to audit all modification actions, making it a technically correct step in the auditing process.

Go deeper

Related to this question