hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A regulated company requires a log of all actions…
A regulated company requires a log of all actions taken by Google support engineers when they access customer GCP environments during support cases. Which Cloud Audit Log type captures this?
⚠ Common exam trap
A common mix-up: candidates confuse 'Data Access logs' with 'Access Transparency logs,' assuming a filter can isolate Google-initiated actions, but Access Transparency is a separate, dedicated log type specifically for Google personnel access, not a subset of Data Access logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access Transparency logs
Access Transparency logs are the correct choice because they specifically capture actions taken by Google support engineers when accessing customer data or configurations in GCP. These logs provide near real-time records of Google-initiated access, which is required for regulated companies to audit support personnel activities. Admin Activity logs only record administrative actions by customers, not Google personnel, while Data Access logs with Google-initiated access filter are not a valid log type in Cloud Audit Logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Admin Activity audit logs
Why it's wrong here
Admin Activity audit logs record administrative actions that modify resource configurations, such as creating instances, changing IAM policies, or deleting services, and are typically initiated by the customer's own IAM principals via API or console. These logs capture the activity of customer-side users and service accounts, not the actions of Google support staff. When Google personnel perform maintenance or troubleshooting on a customer's resources, they do so through internal privileged access tools that do not generate entries in the customer's Admin Activity log stream, making this option incorrect.
- ✗
Data Access audit logs with Google-initiated access filter
Why it's wrong here
Data Access audit logs capture read operations on customer data made through the Cloud Audit Logs API surface, such as GCS object reads triggered by the customer's own service accounts. They do not record actions performed by Google personnel because Google support staff access is routed through internal privileged systems, not the customer's standard API pipeline. Applying a Google-initiated access filter to these logs produces no relevant entries, as the log stream simply lacks Google employee actions.
- ✓
Access Transparency logs
Why this is correct
Access Transparency logs are a specialized Cloud Logging feature specifically designed to record metadata about actions performed by Google personnel when they access customer data and GCP environments. These logs capture the who, when, and why for Google support or engineering access, giving customers visibility and accountability for Google-side activities. Unlike other audit logs, Access Transparency is the only option that directly documents Google employee actions, and it is available in enabled organizations, often in conjunction with Assured Workloads.
- ✗
System event audit logs with personnel filter
Why it's wrong here
System event audit logs track non-user-initiated, system-driven events within GCP, such as automatic maintenance, live migration, or instance preemption. These entries are generated by Google's infrastructure management functions, not by individual Google personnel accessing customer environments. A personnel filter is therefore meaningless here because the actor in these logs is the system or platform, not a named human employee. As a result, System event logs cannot reveal support personnel access.
Go deeper
Related to this question
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.