CCNA Configuring Access and Security Questions

This command correctly opens inbound TCP port 80 to traffic from any IPv4 address (0.0.0.0/0) and applies the rule only to VM instances tagged with 'web-server', matching the requirement precisely. The combination of --source-ranges 0.0.0.0/0 for internet sources and --target-tags web-server to scope the rule to the intended backend VMs is the standard way to allow HTTP in GCP. No other flags are needed, and the protocol:port syntax 'tcp:80' is accurately specified.

This command explicitly creates a subnet in a custom mode VPC (assuming the VPC already exists) and enables Private Google Access, allowing instances in that subnet to reach Google APIs and services through their internal IP addresses without needing a NAT or external IP. In a custom mode VPC, you must create each subnet manually, and this command defines the region and IP range, making it a required step after the VPC is created. Without this flag, the subnet would lack the Private Google Access capability, which is often a prerequisite for workloads that should reach Google services without public IPs.

For Cloud SQL, customer-managed encryption keys (CMEK) must be supplied at the moment you create the instance. You specify the key with the --disk-encryption-key flag in the gcloud sql instances create command, and the Cloud SQL service account must be granted Cloud KMS CryptoKey Encrypter/Decrypter permissions so it can use the key to encrypt data at rest. If these permissions are missing, instance creation fails; the key cannot be retroactively attached to an existing instance because the encryption setting is immutable.

Setting an organization policy constraint (iam.disableServiceAccountKeyCreation is not relevant; here it's a custom constraint or the predefined compute.disableNestedVirtualization? Actually for CMEK, the relevant org policy is a custom constraint or the new `constraints/compute.requireCmek` that enforces CMEK on new Compute Engine disks at creation time. This is the only preventive control among the options because it blocks the disk-creation API call unless a valid CMEK key is supplied, making noncompliant instances impossible to create. It operates at the organization or folder level and is enforced by the resource manager before the Compute Engine API accepts the request.

roles/secretmanager.admin is the correct choice because it grants the full set of Secret Manager permissions needed to create, update, and delete secrets, versions, and their IAM policies. It includes actions such as secretmanager.secrets.create, secretmanager.secrets.update, secretmanager.secrets.delete, and secretmanager.versions.add, allowing complete lifecycle management without granting unrelated service permissions.

This is correct because VPC networks include an implicit deny-all rule for inbound traffic, so the only rule needed is an explicit allow for HTTP traffic (TCP port 80) from all source IP addresses (0.0.0.0/0) to instances tagged with 'web-server'. Target tags let you apply the rule selectively, ensuring only web server VMs accept inbound HTTP while all other instances remain blocked by the implicit deny. No additional deny rule is required or advisable.

Create a service account, grant it the required IAM roles (for example, roles/storage.objectViewer for Cloud Storage read access), and attach it to the instance using the --service-account flag at instance creation time. The instance then automatically authenticates to Google Cloud APIs through the instance's metadata server, which provides OAuth 2.0 access tokens on behalf of the service account without storing any secret material on the disk. This is the standard, secure pattern for granting a Compute Engine instance access to other GCP resources, as it leverages the cloud-native identity and avoids managing static credentials.

IAM deny policies are evaluated with higher precedence than allow policies, so a deny rule on Folder A explicitly blocks any inherited editor grant from reaching resources below that folder. Project 1, being a child of Folder A, inherits both the organization-level editor role and the folder-level deny, but deny rules win. As a result, even though the user was granted editor at the organization, the user's effective permissions in Project 1 do not include editor; the deny policy specifically prevents that role from being granted.

Assigning Storage Object Viewer at the project level grants read-only access to all objects in all buckets by default, but binding that grant with an IAM Condition that checks the resource name (e.g., resource.name.startsWith("projects/_/buckets/audit-")) restricts the access to exactly the intended buckets at access time. The auditor can then list and read objects only within those matches, while the project-level policy remains a single, centrally managed binding that can be audited and adjusted without touching each bucket. This delivers the least-privilege read-only guarantee the auditor needs while keeping operations scalable and governance clean.

Cloud SQL with CMEK uses the customer-managed key for every data-plane operation, including reads and writes to the database, logs, and system tables. When the key is disabled, the instance loses access to the key material, causing the database engine to fail all I/O requests immediately. Consequently, the instance becomes unavailable and cannot be started or used until the key is re-enabled in Cloud KMS; re-enabling the key automatically restores normal operation without manual intervention.

`gcloud projects get-iam-policy my-project --format json` is the correct command for viewing the current IAM policy of a project. It retrieves the full policy, including all role bindings, conditions, and the etag, and returns it in a structured JSON format. The `--format json` flag ensures the output is machine-readable, which is useful for auditing, scripting, or feeding into other tools like `jq`. This command performs no mutation and is the standard way to inspect IAM policy state.

This is correct because Data Access audit logs are controlled by the auditConfig field of the project's IAM policy. You retrieve the policy, add an auditConfig specifying the services and log types (ADMIN_READ, DATA_READ, DATA_WRITE), then set it back with gcloud projects set-iam-policy. After that, Cloud Audit Logs will start recording data access operations for the enabled services.

For Cloud NAT to work, the VPC network must contain a default route (0.0.0.0/0) whose next hop is the default internet gateway. This route is what causes outbound packets from instances to be sent to the gateway, where Cloud NAT performs the source IP translation. Without this route, packets destined for the internet have no valid next hop and are dropped, so the instances cannot reach the internet at all—Cloud NAT alone does not create routing logic.

This correctly adds an IAM policy binding on my-project, which owns the Container Registry artifacts, and defines the member as the service account from other-project using the `serviceAccount:` prefix. Since `roles/storage.objectViewer` grants read access to Cloud Storage objects that back GCR, this allows sa@other-project.iam.gserviceaccount.com to pull images and list repositories in my-project without needing a key or user account. The binding is cross-project: the member belongs to other-project, but the resource is in my-project, which is exactly the required configuration.

Enabling Data Access audit logs for the Cloud Storage service is correct because these logs specifically record every successful and failed read, write, and metadata operation on objects and buckets. By default, Data Access audit logs are disabled, so they must be explicitly turned on for Cloud Storage for the auditor to capture access attempts. Once enabled, each entry includes the principal, source IP, operation (e.g. storage.objects.get), and timestamp—providing the detailed evidence needed for an audit trail.

Creating a dedicated service account, granting it only the required Cloud Storage IAM roles such as roles/storage.objectViewer, and attaching it to the instance with the --service-account flag at creation time follows the principle of least privilege. The VM's metadata server then provides short-lived access tokens to the application, avoiding the need to manage or download any service account keys. This is the recommended, secure pattern for a GCE workload to access Cloud Storage with minimal permissions.

This is the correct read-only command for retrieving a project's IAM policy. It outputs the complete policy document, including bindings, version, etag, and audit configs, and '--format json' formats that document as JSON for easy parsing. It is the standard tool for viewing current IAM state and is the basis for making offline changes with set-iam-policy.

A Cloud Router is the correct component because Cloud NAT requires a Cloud Router in the same region and VPC network to function. The Cloud Router holds the NAT gateway's configuration, manages the NAT IP addresses, and dynamically exchanges routes with the VPC network. Without a Cloud Router, Cloud NAT cannot be created or operate, making it the essential resource for allowing private Compute Engine instances to access the internet or other destinations while remaining private.

Granting authorized users the roles/cloudkms.cryptoKeyEncrypterDecrypter role on the Cloud KMS key is correct because this IAM role grants permission to call the Cloud KMS Encrypt and Decrypt operations, which are required for objects to be uploaded with and read from a CMEK-encrypted bucket. Even if a user has bucket-level permissions, they cannot create or read objects encrypted with that key unless they have this role on the key itself. This ensures only the intended authorized principals can use the customer-managed key for cryptographic operations.

Secret Manager is the dedicated Google Cloud service for storing, managing, and accessing secrets such as API keys, passwords, and certificates. It provides built-in secret versioning with immutable payloads, IAM-based access control at the secret-version level, automatic replication for high availability, and full audit logging via Cloud Audit Logs. This makes it the managed and scalable solution that directly matches the requirement.

When creating an instance, you must specify the service account with `gcloud compute instances create --service-account <SA_EMAIL>`, which attaches that identity to the instance for its entire lifetime. Once attached, the instance metadata server returns OAuth credentials for that service account, so all API calls from the instance are made as that identity. This is the correct way to ensure the instance uses a custom, least-privileged service account, provided the account has been granted the necessary IAM roles.

roles/secretmanager.secretAccessor is the correct predefined role for accessing a secret payload because it includes the secretmanager.versions.access permission, which is the exact IAM permission required to retrieve the stored database password. This role is narrowly scoped; it grants no management capabilities like secret creation, deletion, or IAM policy changes. For a developer whose sole need is to fetch the secret value at runtime, this role provides the minimum access needed while supporting least privilege best practices.

This is the correct prerequisite for enabling CMEK on a Cloud SQL instance. You must create a key ring and a crypto key in Cloud KMS, then grant the Cloud SQL service account (e.g., service-<project>@gcp-sa-cloudsql.iam.gserviceaccount.com) the cloudkms.cryptoKeyEncrypterDecrypter role. That IAM binding lets Cloud SQL call Cloud KMS to encrypt and decrypt the data encryption keys used to protect the instance.

This Organization Policy constraint on Compute Engine restricts the service accounts that can be attached to newly created VM instances. It is the correct control because the requirement is to ensure all instances run under a specific identity: when you configure constraints/compute.setServiceAccount with an allowlist of permitted service account IDs, any attempt to create an instance with a different service account is rejected. This prevents a developer from accidentally or intentionally launching a workload as a privileged service account.

This rule is correct because it pairs a source range of 10.0.1.0/24—exactly matching subnet-a—with a target tag, such as 'https-server', that is applied only to the specific instance in subnet-b. The VPC firewall rule then evaluates the source IP of the incoming packet against the allowed CIDR and the destination instance's effective firewall tags to determine whether to permit TCP 443. Since both conditions are tightly scoped, the rule enforces the intended access: only instances in subnet-a can reach that one HTTPS server, and all other traffic is implicitly denied.

Private Google Access is a subnet-level setting that already routes traffic from VM instances with only internal IP addresses to Google APIs and services over Google's internal network. When this is enabled on the subnet, DNS resolution for googleapis.com automatically maps to Google's internal IP ranges, so the existing VPC routing handles API calls without any extra networking components. Therefore, no additional configuration is required.

The retention policy on the Cloud Storage bucket prevents objects from being deleted or overwritten for a specified duration, and object versioning preserves every version of each object, so even if an object is deleted or replaced, an immutable prior version remains. This is critical for compliance because audit logs must be tamper-proof and available for a multi-year period. However, this step alone does not capture logs; it secures the destination bucket where the log sink delivers exported log entries.

This is the correct command. `gcloud projects get-iam-policy` invokes the Cloud Resource Manager `getIamPolicy` API for the specified project, and the `--format json` flag requests the output as a structured JSON object containing the policy's `etag`, `version`, and `bindings`. It is the standard way to view all project-level IAM bindings.

This is the correct command. It uses the 'gcloud projects get-iam-policy' subcommand to retrieve the IAM policy for the specified project ID ('my-project') and sets the output format to JSON via '--format json'. The command returns the Policy object containing bindings, roles, members, etag, and version, all serialized in the requested JSON structure.

Granting roles/compute.securityAdmin at the folder level is the most precise solution because this role includes the compute.firewalls.create, compute.firewalls.update, and compute.firewalls.delete permissions needed to manage firewall rules, but does not include broader permissions to manage instances, networks, or IAM. IAM policies at the folder level are inherited by all projects and resources within that folder, so this single binding covers every descendant project, including newly created ones. This follows least privilege by granting exactly the permissions needed for firewall rule management and nothing extra.

Secret Manager is the dedicated GCP service for securely storing secrets such as database passwords, API keys, and TLS certificates. It provides automatic encryption at rest and in transit, granular IAM-permission binding, versioning, and audit logging, enabling applications to retrieve secrets on demand via API without embedding them in code. As a fully managed and centralized secret store, it is purpose-built to safeguard database credentials in compliance with security best practices.

Admin Activity audit logs are enabled by default for every Google Cloud project and record all IAM policy changes, including modifications to roles, bindings, and service account keys. To see who changed permissions, you can go directly to the Logs Explorer and query protoPayload.methodName=SetIamPolicy without creating any sinks or enabling additional features. This is the only option that directly answers the question with zero configuration effort.

This is the correct command because it explicitly instructs Compute Engine to provision a Google-managed certificate for the specified domains. The --domains flag triggers Google's automatic certificate management lifecycle: Google Cloud obtains the certificate and handles renewals approximately 30 days before expiration, though you must verify domain ownership first. After creation, the certificate resource still needs to be attached to a target HTTPS proxy and associated with a forwarding rule before it can serve traffic.

roles/iam.serviceAccountUser is the correct role because it includes the permissions iam.serviceAccounts.actAs and iam.serviceAccounts.implicitDelegation. The actAs permission allows a principal to use the service account to access resources and create resources that are owned by or signed with the service account's identity. ImplicitDelegation also permits the principal to impersonate service accounts that are arranged in a delegated chain, making this the minimal standard role for granting a service account the ability to act on behalf of another entity.

This is the correct sequence: first, `gcloud iam service-accounts create` provisions the service account and generates its unique email address, which becomes the IAM member identity. Then, `gcloud projects add-iam-policy-binding` adds that service account email as a member in the project's IAM policy and grants the specified role (e.g., roles/storage.objectAdmin) for the whole project. This binds the service account as an identity to the project-level resource, which is exactly what is needed.

Correct: This rule allows the desired traffic.

roles/compute.instanceAdmin.v1 is a predefined IAM role specifically designed for managing Compute Engine instances without granting broader administrative power. It includes permissions to start, stop, and reset instances, as well as modify metadata and change instance settings, but it does not allow deleting instances or creating new ones. This role exactly matches the requirement of enabling a service account to start and stop instances while maintaining least privilege.

This rule is correct because it explicitly restricts inbound HTTPS (TCP port 443) to source IPs within the RFC 1918 private range 192.168.0.0/16 and applies only to VM instances bearing the network tag 'web-server'. The combination of --source-ranges with a CIDR and --target-tags ensures the rule targets exactly the intended web servers and only allows traffic from the specified internal subnet, satisfying the requirement.

The `gcloud compute ssl-certificates create` command with the `--domains` flag provisions a Google-managed SSL certificate, which satisfies the stem’s requirement for a Google-managed certificate rather than a self-managed one. This command triggers Google’s Certificate Authority to automatically handle domain validation and renewal for `example.com`, eliminating the need for manual certificate uploads. It directly attaches to the HTTPS load balancer’s target proxy, meeting the load-balancer constraint.

This is the exact, valid CLI command for retrieving a project's IAM policy. The subcommand get-iam-policy reads the IAM policy bound to the specified project resource, and --format json renders it as a JSON array of bindings, including roles, members, and conditions. It is the correct tool for this task.

roles/iam.securityReviewer is the correct choice because it grants permission to view IAM policies (for example, 'getIamPolicy') across all resources without allowing any modifications. It also includes permissions to list and get roles, which is exactly what an external auditor needs to review access configuration. This role aligns with least privilege for a read-only audit.

Cloud NAT is implemented as a NAT gateway configured on a Cloud Router, and this pair is the required core of the service. The Cloud Router holds the NAT IP addresses and manages the dynamic routes (via BGP) that allow private instances to use them, while the NAT gateway performs source address translation for outbound connections. Without a NAT gateway, a Cloud Router alone cannot translate addresses, which is why both components are mandatory for a functioning Cloud NAT.

Granting roles/iam.securityReviewer at the folder level is correct because IAM permissions propagate through the resource hierarchy. This predefined role includes resourcemanager.folders.getIamPolicy and resourcemanager.projects.getIamPolicy, allowing the user to read IAM policies on the folder and every project, folder, and resource beneath it. Because the audit scope is the entire folder hierarchy, one grant at the folder root covers all child projects without per-project assignments, satisfying the requirement efficiently and with least privilege.

VPC Network Peering directly connects two VPC networks over Google's private backbone, allowing instances in each network to communicate using internal RFC 1918 addresses without needing public IPs or a VPN. It is the recommended method for inter-VPC connectivity because it offers low latency, no bandwidth restrictions, and no single point of failure. Peering works across projects and organizations, and it automatically exchanges routes for all subnets in the peered networks, so it fully satisfies the requirement to connect multiple VPC networks.

Admin Activity audit logs are enabled by default and capture all API calls that modify the configuration or metadata of resources, including IAM policy updates. For an organization with multiple folders, these logs at the org level record IAM binding changes on any resource in the hierarchy, such as 'setIamPolicy' from projects or folders. They provide an audit trail of who changed what, when, from where, and for which resource, making them the correct log type for investigating IAM policy modifications.

gcloud projects add-iam-policy-binding PROJECT_ID --member=user:email@example.com --role=roles/viewer is the correct command because it performs an additive update to the project's IAM policy. It reads the current policy, appends the new binding (role + member) to the existing set, and writes the merged policy back atomically, leaving all other bindings untouched. This is the standard CLI operation for granting a specific role to a user at the project scope.

`gcloud storage buckets add-iam-policy-binding` is the dedicated command to add a single IAM binding on a specific Cloud Storage bucket. You specify the bucket name with `--member` and `--role` to grant that role directly to a user, group, or service account at the bucket level. This is a valid, surgical way to grant permissions to exactly that bucket and no other resource.

This is the correct command to retrieve the IAM policy for a specific project, and using `--format json` explicitly instructs the CLI to output the policy as a JSON object. The `--format` flag does not change the underlying policy data, but it provides a structured, machine-readable representation that is ideal for scripting with tools like `jq` or for programmatic inspection. Without this flag, the same data would be rendered in YAML by default, so this flag only ensures the output format is standard and predictable.

Using Log Explorer in the Google Cloud console lets you query and filter audit logs once they are enabled. By applying a filter for the Cloud Storage service and the 'data_access' log type, you can view object-level operations such as writes, deletes, and overwrites. This is the final step that makes the audit trail visible and actionable for compliance, but it requires Data Access logging to already be enabled in the IAM audit config.

Data Access audit logs are the correct Cloud Audit Logs category for recording data-plane read/write operations, including Cloud Storage object GETs, BigQuery query reads, and Pub/Sub message publishes/pulls. They are typically disabled by default for most services and must be explicitly enabled for each service in the Audit Logs configuration, after which they deliver the who/what/when trail needed to audit data access across the organization.

Compute Engine requires an instance to be in the TERMINATED state before its service account can be changed, so you must stop the instance first. The gcloud compute instances set-service-account command updates the attached service account (and optionally the access scopes), and then you start the instance to apply the change. This approach preserves the existing VM, avoids resource recreation or workload migration, and is the documented way to attach a service account to an existing instance.

Customer-Managed Encryption Keys (CMEK) is correct because it lets you control and automate key rotation through Cloud KMS. You define a rotation period (e.g., 30 days) on a key, and Cloud KMS automatically generates a new key version on that schedule while continuing to decrypt data with older versions. This provides both automated rotation and full auditability of when each version is used, which aligns with a company's requirement to rotate encryption keys without manual intervention.

Creating a dedicated service account, granting it only the IAM roles the application needs, and passing it via the --service-account flag at instance creation time is the Google-recommended pattern. This attaches the identity to the instance without ever downloading a key, so the instance authenticates through the metadata server's short-lived OAuth tokens. It ensures least privilege and avoids the security risk of storing long-lived credentials on the VM.

The --domains flag is the correct mechanism to request a Google-managed certificate: gcloud will create an SslCertificate resource in MANAGED state, and Google's Certificate Authority will issue a certificate for the specified domain, handling the entire lifecycle including automatic renewal. No additional flags are required, because the presence of --domains unambiguously selects the managed provisioning mode. This command is the exact answer for creating a managed certificate via the gcloud CLI.

The `--default-encryption-key` flag, when used with `gsutil mb`, sets the bucket's default customer-managed encryption key at creation time. The value must be the full resource ID in the format `projects/PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY`. This ensures every object uploaded to the bucket is automatically encrypted with that KMS key, enforcing encryption at rest for all data without requiring per-object flags.

The subnet-level flag --enable-private-ip-google-access is the required element because it configures the VPC subnet to route traffic from instances without external IPs directly to Google's public API endpoints over the Google network. Without this flag, VMs that lack an external IP address cannot reach Google APIs and services, even if the subnet has a default route with an internet gateway. This flag is set per subnet, and enabling it on the relevant subnet is the fundamental prerequisite for Private Google Access.

roles/pubsub.publisher is the correct least-privilege choice because it contains only the pubsub.topics.publish permission, which is exactly what a producer needs to send messages to a Pub/Sub topic. It does not grant permission to create, delete, or modify topics, subscribe, or manage IAM, so a compromised token from this service account could not reconfigure messaging infrastructure.

This is the correct flag. According to the gcloud compute networks subnets update documentation, "--enable-private-ip-google-access" modifies the subnet's privateIpGoogleAccess field, allowing VM instances without external IP addresses to reach Google APIs using the subnet's default route. This is the only flag listed that maps directly to the REST API parameter.

roles/secretmanager.secretManager grants permissions to create, get, list, update, and delete secret resources, plus view metadata, but deliberately omits secretmanager.versions.access. This lets developers fully manage the secret lifecycle without ever being able to view the sensitive payload, making it the correct least-privilege choice for the stated requirement to create and manage secrets while preventing access to values.

roles/logging.viewer is the predefined role for read-only access to Cloud Logging data. It includes permissions such as logging.logEntries.list, logging.logEntries.get, and logging.logs.list, which are required to view audit logs in the Logs Explorer. This role cannot modify log sinks or delete logs, providing the least-privileged access to view audit logs.

Data Access audit logs for Cloud Storage capture object-level read (e.g., object.get) and write (e.g., object.create) API calls, including the principal, source IP, timestamp, and the specific resource accessed. Because Data Access audit logs are disabled by default, they must be explicitly enabled in the project's IAM audit config to satisfy security auditing requirements.

Admin Activity audit logs record all API calls that modify configuration or metadata of resources, including IAM policy changes. In Cloud Logging, they are enabled by default and retained for 400 days. Since setting an IAM policy (e.g., projects.setIamPolicy) is a configuration-modifying operation, it's captured here. That's why this is the correct choice.

A Cloud Router alone is only a BGP session manager; it does not perform address translation by itself. To enable NAT on a VPC, you must explicitly create a Cloud NAT gateway and attach it to the Cloud Router for a given region and subnetwork, which then maps private IPs to a pool of external IPs. Without that gateway, outbound packets from private instances are dropped when they try to reach the internet, regardless of routing.

Cloud NAT is designed to provide source network address translation for private instances that do not have external IP addresses. If an instance is assigned an external IP, even an ephemeral one, its outbound traffic will use that IP as the source address, completely bypassing Cloud NAT. Therefore, the observation that traffic is 'not being NATed' is exactly what would happen when instances have external IPs, not a sign of NAT misconfiguration.

Correct: Deleting default rules removes internet ingress and the default allow-all-internal rule. New rule restricts internal communication to port 443.

Google-managed certificates automatically handle both provisioning and renewal, so you never have to manually track expiration dates or replace certificates. After you configure the certificate on an HTTPS target proxy, Google Cloud's certificate manager regularly checks the certificate's validity and renews it approximately 30 days before expiration, provided the domain's DNS record still points to the load balancer. This automation is the key advantage because it prevents outages caused by expired certificates.

gcloud projects add-iam-policy-binding is the precise command to grant an existing service account an IAM role on a project. It performs an additive update to the project's IAM policy, leaving all other bindings intact, which is exactly what is needed when automating service account creation and subsequent access provisioning. The command requires the service account's email as the member and the role name (e.g., roles/storage.objectViewer), and it applies the binding only at the project level, matching the scenario.

roles/secretmanager.secretAccessor is the correct and minimal predefined role for service accounts that need to retrieve secret payloads. It includes the `secretmanager.versions.access` permission, which allows the caller to access the encryption-decrypted secret value from a specified version, and `secretmanager.versions.get` for metadata of that version. It does not permit creating, deleting, or modifying secrets, nor changing IAM policies, making it the exact role for a workload that reads a secret at runtime without administrative side effects.

Secret Manager is the correct choice because it is Google Cloud's purpose-built service for storing sensitive data such as database passwords, API keys, and certificates. It provides fine-grained IAM policies, automatic versioning, audit logging of secret access, and integration with services like Cloud Functions and GKE. Additionally, it supports secret rotation and allows you to enforce retention policies, making it the secure and native solution for managing a database password.

In Google Cloud VPC firewall rules, priority values determine evaluation order; lower numbers are evaluated first. The deny rule has a priority of 500, whereas the allow rule has 1000, so the deny rule is matched first. Because GCP applies the first matching rule and then stops, the traffic is denied before the allow rule is ever considered.

This is the correct approach: Data Access audit logs for Cloud Storage are enabled by adding a Cloud Storage audit config at the project, folder, or organization level using the IAM 'Audit Logs' tab or by setting an auditConfig in the IAM policy. You can specify the service storage.googleapis.com and include the desired permission types—ADMIN_READ, DATA_READ, DATA_WRITE—or use ALL. After the audit config is applied, Cloud Logging begins recording data access events on the matching buckets automatically, with no further per-bucket steps needed.

Enabling the --enable-private-ip-google-access flag on the subnet is the core requirement because it tells Google Cloud to allow instances in that subnet to reach Google APIs using only their internal IP addresses. After this flag is set, the VPC's routing table automatically includes a route for Google's API ranges that sends traffic over the internal Google network instead of the public internet. This flag must be present on every subnet where you want Private Google Access to work; enabling it on the VPC or a single instance is not possible.

This command correctly retrieves the IAM policy for the specified GCP project, including all role bindings for members at the project level. The --format json flag ensures the output is machine-readable JSON, which is useful for automation or programmatic inspection. It is the standard gcloud command for viewing project-level IAM policies.

This is the correct operational behavior. After rotating the key version in Cloud KMS, you must restart the Cloud SQL instance using the console, gcloud command, or API so that it recognizes the new key version as the encryption key for upcoming writes. The restart is required because the instance caches the old key version in memory, and the new version is only picked up during instance startup. This allows existing data to still be decrypted with the prior version while new encrypted data uses the updated version.

The `roles/secretmanager.admin` role includes the `secretmanager.secrets.create` permission required for adding a new secret via the Cloud Console, gcloud CLI, or Secret Manager API. It also grants full management of versions, IAM policies, and deletion, so it is the predefined role that reliably supports all CI/CD operations that need to provision and rotate secrets.