mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: A security analyst needs to retrieve all Cloud…
A security analyst needs to retrieve all Cloud Logging entries with severity ERROR or higher across all resource types in the current project. Which log query correctly filters these entries?
⚠ Common exam trap
Google Cloud often tests the nuance that severity values must be quoted strings and that comparison operators like `>=` work on the underlying numeric severity levels, not on string lexicographic order, leading candidates to mistakenly use unquoted values or incorrect operators like `>`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
severity >= "ERROR"
Cloud Logging's query language supports comparison operators like `>=` for severity levels, where `ERROR` is a recognized severity level. The query `severity >= "ERROR"` retrieves all entries with severity ERROR, CRITICAL, ALERT, or EMERGENCY, as these are considered higher severity than ERROR. This matches the requirement to filter for severity ERROR or higher across all resource types without restricting the time range or resource type.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
severity >= ERROR AND timestamp > now() - 24h
Why it's wrong here
The query uses invalid syntax: severity values must be quoted strings in Cloud Logging's logging query language, so `severity >= ERROR` should be `severity >= "ERROR"`. Also, `now()` is not a supported function; you should use a relative time range in the console's time selector (e.g., "Last 1 day") or an absolute ISO 8601 timestamp. Even if corrected, the explicit timestamp filter is redundant because the time range is usually specified in the Logs Explorer UI.
- ✗
severity="ERROR" AND resource.type="gce_instance"
Why it's wrong here
This query restricts the search to only GCE instance resource types, which would miss relevant logs from other services like Cloud Run or Kubernetes. It also uses an exact match `severity="ERROR"`, which includes only the ERROR level and excludes CRITICAL, ALERT, and EMERGENCY—thus failing to capture more severe entries. To capture all entries at or above a threshold, use the `>=` operator.
- ✓
severity >= "ERROR"
Why this is correct
Using `severity >= "ERROR"` correctly matches all log entries with severity level ERROR or higher (CRITICAL, ALERT, EMERGENCY) across all resource types, which is the intended scope. The time range is not part of the filter; you set the range (e.g., last 24 hours) via the time picker in the Cloud Console, which is a best practice. This filter is precise and avoids unnecessary restrictions on log streams or resource types.
- ✗
logName="projects/my-project/logs/stderr" AND severity > "WARNING"
Why it's wrong here
This query narrows the search to only the stderr log stream for the project, which is unnecessary if you want all ERROR and higher entries. Additionally, the comparison operator `>` is exclusive, meaning severity levels are ordered numerically (DEFAULT=0, DEBUG=100, INFO=200, NOTICE=300, WARNING=400, ERROR=500, CRITICAL=600, ALERT=700, EMERGENCY=800), so `severity > "WARNING"` would only match CRITICAL and above, not ERROR (500) because 500 is not greater than 400. Use `>= "ERROR"` to include ERROR and all higher severities.
Go deeper
Related to this question
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.