Cloud Digital Leader Trust and security with Google Cloud Practice Question

A cloud architect wants to ensure that only certain users in the finance team can access a Cloud Storage bucket containing invoices. They also want to log all access attempts. Which two services should they use?

⚠ Common exam trap

Google Cloud often tests the distinction between network-level services (like Cloud NAT, Cloud Load Balancing, Cloud CDN) and identity/audit services (IAM, Cloud Audit Logs), so candidates mistakenly choose networking options when the question explicitly asks about user access control and logging.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

IAM and Cloud Audit Logs

IAM (Identity and Access Management) is used to grant specific users (e.g., finance team members) granular access to the Cloud Storage bucket via roles like roles/storage.objectViewer. Cloud Audit Logs (specifically Admin Activity and Data Access audit logs) capture all access attempts, including who accessed the bucket, when, and from which IP address, meeting the logging requirement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
IAM and Cloud Audit Logs
Why this is correct
IAM is the native Google Cloud service for fine-grained identity and access management; it binds principals to roles that contain permissions, letting you define exactly which users can perform specific actions on specific resources. Cloud Audit Logs records Admin Activity and Data Access logs, and the Data Access logs specifically capture data reads and modifications, so together they provide both enforcement of the 'only certain users' restriction and the audit trail to verify and investigate that restriction. This combination satisfies the access-control requirement and the logging requirement simultaneously, which is why it is correct.
✗
Cloud NAT and Cloud Audit Logs
Why it's wrong here
Cloud NAT is a network service that provides outbound internet connectivity for private instances by translating private IP addresses to public addresses; it does not authenticate users or authorize access, so it cannot restrict which users are allowed to use a resource. While Cloud Audit Logs does address the logging half of the requirement, pairing it with Cloud NAT leaves the access-control half completely unaddressed, because no identity-aware control is in place to define 'only certain users'.
✗
Cloud NAT and Cloud Load Balancing
Why it's wrong here
Both Cloud NAT and Cloud Load Balancing are networking components: Cloud NAT enables outbound internet egress from private instances, and Cloud Load Balancing distributes inbound traffic across backend instances. Neither service inspects user identity or enforces user-level permissions, and Cloud Load Balancing logs traffic metadata (e.g., request counts, latency) rather than data-access audit events. This combination therefore lacks both the access-control mechanism and the audit logging capability needed to meet the requirement.
✗
IAM and Cloud CDN
Why it's wrong here
IAM does provide the necessary access control by granting only certain users specific roles, so this combination partially satisfies the requirement. However, Cloud CDN is a content delivery network that caches content at edge locations to improve performance; it does not produce data-access audit logs and cannot reveal which user read or modified sensitive data. To complete the logging requirement, you need Cloud Audit Logs, not Cloud CDN, which is why this option is incorrect.

Go deeper

Cloud Digital Leader Trust and security with Google Cloud Practice Question

Why each option matters

Option-by-option breakdown

Related to this question