Google ACE Practice Question: The purpose of Cloud Audit Logs' Data Access…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  They record authentication events; they are disabled by default due to privacy regulations.

  Why it's wrong here

  Data Access logs do not focus on authentication events; those are captured in Admin Activity logs alongside configuration changes, while sign-in failures may appear in Cloud Logging from the authentication layer. Privacy regulations are not the driver for the default-off setting — the prohibitive volume and storage cost of logging all data reads and writes is. Audit logs are a standard compliance tool and can be enabled while respecting privacy through redaction and access controls.

• ✓

  They log API calls that read or write user data; they are off by default due to very high log volume and associated storage costs.

  Why this is correct

  Data Access audit logs capture every API call that reads or writes user data, such as when a BigQuery job reads table contents or a Cloud Storage object is downloaded. They are disabled by default because on heavily used services the sheer volume of these calls can generate terabytes of logs, making storage costs prohibitive. Administrators can selectively enable them per bucket, project, or folder to balance compliance needs against cost and performance impact.

• ✗

  They log VM instance creation and deletion; they are disabled by default to avoid noise.

  Why it's wrong here

  VM instance creation and deletion are lifecycle events recorded in Admin Activity audit logs, which are always enabled and free of charge. Data Access audit logs, by contrast, are concerned with data-plane operations on user content, not infrastructure lifecycle changes. The reason Data Access logs are off by default is not to avoid noise from instance events but to prevent the overwhelming log volume generated by every read/write request on data services.

• ✗

  They provide real-time threat detection; they are experimental and not yet generally available.

  Why it's wrong here

  Data Access audit logs are generally available (GA) and serve forensic and compliance purposes by recording historical API activity. They are not an experimental feature for real-time threat detection; that responsibility belongs to Security Command Center, which ingests findings and provides event detection. Audit logs are analyzed after the fact, whereas real-time detection requires streaming and alerting on security signals as they occur.

Go deeper

Related to this question