Google ACE Configuring Access and Security Practice Question
An organization needs to audit all data access (read/write) to a Cloud Storage bucket for compliance. Which type of audit log should they enable?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Access audit logs
Data Access audit logs record who accessed what data, including read and write operations. Admin Activity logs record changes to configurations, not data access. To enable Data Access logs, they need to configure the audit policy at the organization, folder, or project level for the specific service (storage.googleapis.com).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
System Event audit logs
Why it's wrong here
System Event audit logs are a distinct Cloud Audit Logs category that records non-data administrative events originated by Google Cloud, such as VM live migration, automatic OS patching, or service enablement. They capture Google-engineered control-plane actions, not API calls that read or write customer data, so they cannot serve as an audit trail for user data access read/write operations.
- ✗
Access Transparency logs
Why it's wrong here
Access Transparency logs report actions performed by Google employees or automated systems on your customer data, such as a support engineer reviewing a BigQuery dataset during troubleshooting. These logs are designed to show you what Google Cloud did to your content, not what your own users did, so they do not capture the read/write data access events your organization needs to audit.
- ✗
Admin Activity audit logs
Why it's wrong here
Admin Activity audit logs track control-plane configuration and metadata changes, like creating a VM, updating a firewall rule, or modifying IAM roles. They do not contain data-plane operations such as reading a Cloud Storage object or writing to a BigQuery table, so they cannot be used to audit all user data accesses; the requirements explicitly call for read/write audit coverage, which Admin Activity logs cannot provide.
- ✓
Data Access audit logs
Why this is correct
Data Access audit logs are the correct Cloud Audit Logs category for recording data-plane read/write operations, including Cloud Storage object GETs, BigQuery query reads, and Pub/Sub message publishes/pulls. They are typically disabled by default for most services and must be explicitly enabled for each service in the Audit Logs configuration, after which they deliver the who/what/when trail needed to audit data access across the organization.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Folder
A folder is a logical container used to organize and group digital files, resources, or cloud-based assets within a system or platform.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.