Google ACE Configuring Access and Security Practice Question
A security team wants to enable audit logging for all Data Access (ADMIN_READ, DATA_READ, DATA_WRITE) on a specific Google Cloud project. They plan to use gcloud commands to configure this. What is the correct approach?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use gcloud projects set-iam-policy to set the auditConfig on the project.
Audit log configuration is set at the organization, folder, or project level using the 'gcloud projects get-iam-policy' and 'gcloud projects set-iam-policy' commands with audit configs. The correct method is to modify the IAM policy to include auditConfigs. The other options either use wrong commands or wrong scopes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use gcloud compute firewall-rules update to enable logging on firewall rules.
Why it's wrong here
This command only toggles firewall rules logging, which records metadata about connections allowed or denied by VPC firewall rules. It does not affect audit logging for data access, because firewall logging is a separate VPC flow log feature, not a Cloud Audit Log. Enabling it would generate firewall logs, not the Data Access logs you need for access audits.
- ✗
Use gcloud logging sinks to export data access logs to a BigQuery dataset.
Why it's wrong here
Creating a logging sink merely routes existing Cloud Logging entries to a BigQuery dataset for long-term storage or analysis. It does not turn on Data Access audit logs, because sinks only export what is already being collected. Without an auditConfig in the project's IAM policy that enables DATA_READ and DATA_WRITE, those logs are never generated, so there is nothing to export.
- ✓
Use gcloud projects set-iam-policy to set the auditConfig on the project.
Why this is correct
This is correct because Data Access audit logs are controlled by the auditConfig field of the project's IAM policy. You retrieve the policy, add an auditConfig specifying the services and log types (ADMIN_READ, DATA_READ, DATA_WRITE), then set it back with gcloud projects set-iam-policy. After that, Cloud Audit Logs will start recording data access operations for the enabled services.
- ✗
Use gcloud services enable to enable the Cloud Audit Logs API.
Why it's wrong here
The Cloud Audit Logs service is built into Cloud Logging and is always on; there is no separate API to enable for audit logging. gcloud services enable only activates optional Google Cloud service APIs, and enabling them does not modify the auditConfig in IAM policy. Therefore, this command has no effect on whether Data Access logs are recorded.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Google Cloud project
A Google Cloud project is a container that holds all your cloud resources like virtual machines, databases, and storage, acting as the main building block for organizing and managing everything you do in Google Cloud.
Key term
IAM policy
An IAM policy is a set of rules that determines who can access specific cloud resources and what actions they are allowed to perform.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.