hardMultiple ChoiceObjective-mapped
Google ACE Audit all IAM policy changes in your project Practice Question
You need to audit all IAM policy changes in your project. You want to ensure that every change is logged with the identity of the user who made the change. Which type of audit log should you enable?
⚠ Common exam trap
Google Cloud often tests the distinction between Admin Activity and Data Access logs, where candidates mistakenly choose Data Access logs because they think 'all changes' include data modifications, but IAM policy changes are administrative, not data-level, operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Admin Activity audit logs
Admin Activity audit logs (also known as Cloud Audit Logs) record all API calls that modify the configuration or metadata of resources, including IAM policy changes. These logs capture the identity of the user who made the change, the time of the change, and the specific modification, ensuring full accountability for administrative actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Access audit logs
Why it's wrong here
Data Access audit logs record API calls that read or modify user data, such as reading a Cloud Storage object or updating a Firestore document. IAM policy modifications are control-plane configuration changes, not data-plane operations, so they are not included in these logs. Enabling Data Access logs would generate a large volume of data-read events but would still capture none of the IAM binding updates you need to audit.
- ✓
Admin Activity audit logs
Why this is correct
Admin Activity audit logs capture all changes to configurations and metadata, including every IAM role binding, service account creation or deletion, and project-level policy modification. These logs are enabled by default for all projects and cannot be disabled, making them the authoritative source for answering 'who changed an IAM policy and when.' Each entry includes the actor, the action, the affected resource, and the request metadata, so this is the correct log type to audit IAM policy changes.
- ✗
Policy Denied audit logs
Why it's wrong here
Policy Denied audit logs are emitted when an access attempt is blocked by VPC Service Controls or Organization Policy, not when an IAM binding is edited. These logs record the attempted action and the specific org policy that denied it, but they contain no information about IAM policy modifications. They answer the question 'was an action denied and why?' rather than 'what IAM change was made?' so they are not suitable for auditing IAM policy changes.
- ✗
System Event audit logs
Why it's wrong here
System Event audit logs are generated for automated, system-initiated actions such as worker restarts, automatic scaling events, or scheduled Cloud Scheduler jobs. They do not capture user-initiated IAM policy changes because those changes originate from a caller, not from Google's background systems. While these logs help investigate infrastructure automation issues, they are not the right source for a user-driven IAM audit trail.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Cloud Audit Logs
Cloud Audit Logs are a record of actions taken by users, services, and resources inside a cloud environment, capturing who did what, when, and from where.
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.