Google ACE Configuring Access and Security Practice Question
A security team wants to audit all Data Access attempts in a project for a specific Cloud Storage bucket, including who accessed which object and when. Which configuration is required?
⚠ Common exam trap
The trap is confusing Admin Activity logs (configuration changes) with Data Access logs (object reads/writes), leading candidates to pick the wrong log type for auditing data access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Data Access audit logs for Cloud Storage in the project's IAM audit config
To audit data access attempts on a Cloud Storage bucket, including who accessed which object and when, you must enable Data Access audit logs for Cloud Storage in the project's IAM audit configuration. Data Access logs record read and write operations on objects, whereas Admin Activity logs only record configuration changes. Enabling Data Access logs at the project level ensures all bucket access is captured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure VPC Flow Logs on the VPC network
Why it's wrong here
VPC Flow Logs sample and record network traffic metadata—source/destination IP, ports, protocol, and packet counts—for connections traversing VPC networks. They operate at the network layer and have no visibility into GCS object-level operations, so they cannot record whether a user downloaded a specific blob from a bucket.
- ✗
Set up Cloud Monitoring alerts on the bucket
Why it's wrong here
Cloud Monitoring alerts evaluate time-series metrics and can trigger notifications based on conditions like request count or latency, but they do not generate an audit record of who accessed what or when. Alerts are reactive operational tools, not a durable, queryable audit trail for data access attempts.
- ✗
Enable Admin Activity audit logs for Cloud Storage in the project
Why it's wrong here
Admin Activity audit logs (also known as ADMIN_WRITE and ADMIN_READ) record operations that change the configuration or metadata of Google Cloud resources—for example, creating a bucket, deleting a bucket, or modifying IAM policies. They capture control-plane actions, not the data-plane GET/PUT requests that constitute object-level data access in Cloud Storage.
- ✓
Enable Data Access audit logs for Cloud Storage in the project's IAM audit config
Why this is correct
Data Access audit logs for Cloud Storage capture object-level read (e.g., object.get) and write (e.g., object.create) API calls, including the principal, source IP, timestamp, and the specific resource accessed. Because Data Access audit logs are disabled by default, they must be explicitly enabled in the project's IAM audit config to satisfy security auditing requirements.
Go deeper
Related to this question
Learn chapter
Binary Authorization for Supply Chain Security
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
About these practice questions
Courseiva writes every ACE question from scratch — 775 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.