hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A regulated financial company must ensure that…
A regulated financial company must ensure that all GCP API calls made by employees are logged with full request and response payloads for audit purposes. Which combination of Cloud Audit Log types captures this?
⚠ Common exam trap
Google Cloud often tests the misconception that Admin Activity logs alone are sufficient for audit compliance, when in fact they omit the data-level payloads that regulated audits require, and candidates may overlook the need to explicitly enable Data Access logs with full payload inclusion.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Admin Activity logs + Data Access logs (DATA_READ and DATA_WRITE)
Admin Activity logs capture administrative actions like creating or modifying resources, but not the data within API calls. Data Access logs (DATA_READ and DATA_WRITE) capture the request and response payloads for API calls that read or write data, which is required for full audit logging. Together, they cover both the administrative context and the data-level payloads mandated for regulated financial companies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Admin Activity logs only
Why it's wrong here
Admin Activity logs alone capture only control-plane configuration operations, such as creating a VM or changing a firewall rule, and they omit data-plane API calls that read or write payloads, such as Cloud Storage object downloads or BigQuery table reads. Since the requirement is to audit all API calls, the absence of Data Access logs leaves these data operations completely invisible, so relying solely on Admin Activity logs is insufficient.
- ✓
Admin Activity logs + Data Access logs (DATA_READ and DATA_WRITE)
Why this is correct
Admin Activity logs record every API call that creates, modifies, or deletes a resource, including governance changes such as IAM bindings, while Data Access logs capture DATA_READ and DATA_WRITE calls that read or change data, and include the request payload. Together they cover both the control-plane and data-plane aspects of all employee API calls, which is exactly what the scenario requires for complete audit coverage.
- ✗
VPC Flow Logs + Cloud Monitoring metrics
Why it's wrong here
VPC Flow Logs provide network-level metadata like source and destination IP addresses, ports, and packet counts, but they do not parse or record the content of API requests. Cloud Monitoring metrics aggregate signals such as request latency or error rate, but they also fail to capture individual API call details or who made them. Consequently, this pair can indicate that API traffic occurred but cannot attribute specific API calls to employees, so it fails the audit requirement.
- ✗
System event logs + Data Access logs
Why it's wrong here
Data Access logs capture employee-initiated read/write operations and payloads, but System event logs record GCP infrastructure actions such as host maintenance or live migration, not user API calls. This pair omits Admin Activity logs, so configuration-changing API calls like IAM changes or resource deletions are never recorded, making the audit trail incomplete for the stated requirement.
Go deeper
Related to this question
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.