Google ACE Practice Question: A compliance team needs a log of every time a…

A compliance team needs a log of every time a user or service account accessed data in a BigQuery dataset — specifically read operations. Which Cloud Audit Log type captures this?

⚠ Common exam trap

Google Cloud often tests the distinction between Admin Activity logs (which capture resource configuration changes) and Data Access logs (which capture data reads/writes), leading candidates to mistakenly choose Admin Activity for any 'access' scenario.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Data Access audit logs

Data Access audit logs record API calls that read or modify user-provided data, including BigQuery read operations like SELECT queries. Since the requirement is specifically for read operations on user data, Data Access logs are the correct type. Admin Activity logs cover configuration changes, not data reads, and System Event logs cover Google-managed actions, not user-initiated reads.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
System event audit logs
Why it's wrong here
System event audit logs record low-level infrastructure actions initiated by Google Cloud itself, such as preemption of a VM, live migration of an instance to another host, or scheduled maintenance events. These entries are system-generated operational telemetry and contain no user identity, no API method, and no reference to BigQuery data objects. Therefore they tell you nothing about who read a dataset or executed a query, which is the exact question this scenario is trying to answer.
✗
Admin Activity audit logs
Why it's wrong here
Admin Activity audit logs capture configuration-modifying API calls such as creating or deleting a BigQuery dataset, updating IAM policies, or changing resource settings. A data read like a SELECT query or a table access does not change the resource configuration, so it is not recorded in Admin Activity logs. Even if an admin creates a dataset that is later queried, the Admin Activity log only shows the dataset creation event, not the subsequent read access, so it fails to identify who actually read the data.
✓
Data Access audit logs
Why this is correct
Data Access audit logs are the only Cloud Audit Logs category that records the actual 'read' operations on user data. When enabled, they capture BigQuery jobs such as SELECT queries, table reads, and tabledata.list calls, including the identity of the caller, the queried dataset/table, and the timestamp. These logs are opt-in because they can generate enormous volume, but they are essential for security forensics to determine who accessed specific BigQuery data.
✗
VPC flow logs
Why it's wrong here
VPC Flow Logs operate at Layer 3/4 of the network stack, capturing metadata about IP traffic such as source and destination addresses, ports, protocol, and packet counts. They do not inspect application-level payloads or parse Cloud API calls, so they cannot reveal which principal issued a BigQuery query or which dataset was referenced. At best they show that a VM communicated with the BigQuery API endpoint, but they cannot attribute that traffic to a specific user or table, making them unsuitable for auditing data access.

Go deeper

Google ACE Practice Question: A compliance team needs a log of every time a…

Why each option matters

Option-by-option breakdown

Related to this question