Google ACE Practice Question: Ensuring Successful Operation of a Cloud Solution
You have a Cloud Storage bucket that contains sensitive data. You need to ensure that all access to the bucket is logged, including data reads and writes, and that the logs are retained for at least one year. You also want to be able to analyze the logs using BigQuery. What should you do?
⚠ Common exam trap
The trap here is assuming that Admin Activity audit logs include data reads and writes, when in fact Data Access audit logs are needed for that level of detail.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Data Access audit logs for Cloud Storage, create a log sink to BigQuery, and set the retention period on the BigQuery dataset to 365 days.
To log all access to a Cloud Storage bucket, including data reads and writes, you must enable Data Access audit logs. Then, create a log sink to BigQuery for analysis and set the dataset's retention to 365 days. Legacy bucket logging or Admin Activity logs alone do not capture all data access events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Cloud Audit Logs to capture admin activity only, and set up a log sink to BigQuery with a retention period of 365 days.
Why it's wrong here
Admin Activity audit logs capture administrative actions but not data reads and writes. To log data access, you must enable Data Access audit logs. Using only Admin Activity logs would miss the required data access events. Therefore, this does not meet the requirement to log all access.
- ✗
Create a log sink to Cloud Storage, and then use a BigQuery external table to query the logs directly from Cloud Storage.
Why it's wrong here
While you can export logs to Cloud Storage and query them with BigQuery external tables, this does not automatically retain logs for one year unless you configure a retention policy on the bucket. Additionally, external tables have performance limitations and do not provide the same query performance as native BigQuery tables. This is not the most efficient or straightforward solution.
- ✗
Enable Cloud Storage bucket logging by using the gsutil logging set command, and then export the logs to BigQuery using a log sink.
Why it's wrong here
Cloud Storage bucket logging (legacy access logs) records access to the bucket, but it does not capture Data Access audit logs and may not include all the details required. Also, these logs are stored in a separate bucket and would need to be exported. This approach is outdated and not the recommended way to capture audit logs.
- ✓
Enable Data Access audit logs for Cloud Storage, create a log sink to BigQuery, and set the retention period on the BigQuery dataset to 365 days.
Why this is correct
Data Access audit logs capture read and write operations on Cloud Storage. Enabling them ensures all access is logged. A log sink to BigQuery exports the logs for analysis, and setting the dataset's default table expiration to 365 days ensures retention for at least one year. This meets all requirements.
Go deeper
Related to this question
Learn chapter
BigQuery Authorized Views for Access Control
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
Key term
BigQuery
BigQuery is a fully managed, serverless data warehouse on Google Cloud that lets you run fast SQL queries on massive datasets without managing any infrastructure.
About these practice questions
Courseiva writes every ACE question from scratch — 775 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.