Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Configure the Cloud Storage bucket with a retention policy and enable object versioning

  Why this is correct

  The retention policy on the Cloud Storage bucket prevents objects from being deleted or overwritten for a specified duration, and object versioning preserves every version of each object, so even if an object is deleted or replaced, an immutable prior version remains. This is critical for compliance because audit logs must be tamper-proof and available for a multi-year period. However, this step alone does not capture logs; it secures the destination bucket where the log sink delivers exported log entries.

• ✓

  Enable Data Access audit logs for the relevant services in the project's IAM audit config

  Why this is correct

  Data Access audit logs record who accessed what, when, and from where, but they are disabled by default for most services. You must explicitly enable them in the project's IAM audit config for each service (e.g., Cloud Storage, BigQuery) to ensure that all read, write, and admin operations are captured. Without enabling them, there would be no log entries to export or retain, so this is a prerequisite for the entire audit pipeline.

• ✗

  Use the default Logging retention of 30 days

  Why it's wrong here

  Cloud Logging retains log entries for only 30 days by default (with custom retention options extending up to 3650 days, but still not independent of Logging). For a five-year audit requirement, relying on the default retention guarantees that data access logs older than a month will be permanently deleted. You need a log sink to export to Cloud Storage, where you can apply a bucket retention policy and lifecycle management for long-term archival.

• ✗

  Set up a Cloud Monitoring alert for any Data Access log entries

  Why it's wrong here

  A Cloud Monitoring alert policy can be set to match Data Access log entries, but its purpose is to trigger notifications when certain events occur, not to store or preserve log data. The alert itself does not create a repository of logs, nor does it affect Logging's retention limits. It may be useful for real-time detection of unusual access, but it cannot substitute for the combination of enabling Data Access logs, exporting via a sink, and securing the destination bucket.

• ✓

  Create a log sink to export logs to a Cloud Storage bucket

  Why this is correct

  Cloud Logging's built-in storage is not designed for indefinite archival, so you must create a log sink that exports log entries to a Cloud Storage bucket. The sink can filter to include only Data Access logs and route them to a bucket that has a retention policy and versioning enabled. This export is the foundational step for satisfying long-term retention and immutability requirements, because it moves the logs out of Logging's default 30-day lifecycle.

Go deeper

Related to this question