Courseiva
Configuring Access and SecuritymediumMultiple ChoiceObjective-mapped

Google ACE Configuring Access and Security Practice Question

An organization needs to audit all data access (read/write) to a Cloud Storage bucket for compliance. Which type of audit log should they enable?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Data Access audit logs

Data Access audit logs record who accessed what data, including read and write operations. Admin Activity logs record changes to configurations, not data access. To enable Data Access logs, they need to configure the audit policy at the organization, folder, or project level for the specific service (storage.googleapis.com).

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • System Event audit logs

    Why it's wrong here

    System Event audit logs are a distinct Cloud Audit Logs category that records non-data administrative events originated by Google Cloud, such as VM live migration, automatic OS patching, or service enablement. They capture Google-engineered control-plane actions, not API calls that read or write customer data, so they cannot serve as an audit trail for user data access read/write operations.

  • Access Transparency logs

    Why it's wrong here

    Access Transparency logs report actions performed by Google employees or automated systems on your customer data, such as a support engineer reviewing a BigQuery dataset during troubleshooting. These logs are designed to show you what Google Cloud did to your content, not what your own users did, so they do not capture the read/write data access events your organization needs to audit.

  • Admin Activity audit logs

    Why it's wrong here

    Admin Activity audit logs track control-plane configuration and metadata changes, like creating a VM, updating a firewall rule, or modifying IAM roles. They do not contain data-plane operations such as reading a Cloud Storage object or writing to a BigQuery table, so they cannot be used to audit all user data accesses; the requirements explicitly call for read/write audit coverage, which Admin Activity logs cannot provide.

  • Data Access audit logs

    Why this is correct

    Data Access audit logs are the correct Cloud Audit Logs category for recording data-plane read/write operations, including Cloud Storage object GETs, BigQuery query reads, and Pub/Sub message publishes/pulls. They are typically disabled by default for most services and must be explicitly enabled for each service in the Audit Logs configuration, after which they deliver the who/what/when trail needed to audit data access across the organization.

About these practice questions

Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.