Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use gcloud logging to create a log sink for Cloud Storage.

  Why it's wrong here

  A log sink in Cloud Logging exports matching log entries to a destination such as BigQuery or Pub/Sub, but it only forwards logs that already exist—it does not generate or activate Data Access audit logs for Cloud Storage. The audit config is what tells Cloud Logging to record data read/write events; without it, no such entries are produced for the sink to export. Therefore creating a sink alone cannot satisfy the audit logging requirement.

• ✗

  Enable Data Access logs in each bucket's settings.

  Why it's wrong here

  Cloud Storage bucket settings do not include an option for enabling Data Access audit logs; these logs are activated at the project, folder, or organization level through the IAM audit configuration. Within the audit config, you choose the storage.googleapis.com service and select ADMIN_READ, DATA_READ, and DATA_WRITE as needed. Because the setting is inherited by all buckets in the resource hierarchy, per-bucket toggles do not exist and cannot be used.

• ✓

  Configure an organization policy or IAM audit config to enable Data Access logs for Cloud Storage.

  Why this is correct

  This is the correct approach: Data Access audit logs for Cloud Storage are enabled by adding a Cloud Storage audit config at the project, folder, or organization level using the IAM 'Audit Logs' tab or by setting an auditConfig in the IAM policy. You can specify the service storage.googleapis.com and include the desired permission types—ADMIN_READ, DATA_READ, DATA_WRITE—or use ALL. After the audit config is applied, Cloud Logging begins recording data access events on the matching buckets automatically, with no further per-bucket steps needed.

• ✗

  Add an IAM binding with the roles/logging.admin role to a user.

  Why it's wrong here

  Granting a user the roles/logging.admin IAM role gives them administrative control over Cloud Logging—such as creating sinks, managing log-based metrics, and viewing logs—but it does not by itself enable Data Access audit logs. The audit logging configuration is a separate IAM auditConfig resource on the project or organization, not a consequence of assigning a logging role to a user. Even a project owner must explicitly edit the audit config to start capturing data access events for Cloud Storage.

Go deeper

Related to this question