Cloud Digital Leader Google Cloud Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud Monitoring

  Why it's wrong here

  Cloud Monitoring is a metrics-based observability service that aggregates time-series data such as CPU utilization, latency, and disk usage, and triggers alerts based on thresholds. While it can detect the operational aftermath of an admin action (e.g., an error spike after a misconfiguration), it does not record the identity, timestamp, or API call of the administrator who performed the change. Audit trails are simply outside its scope — it is designed for health monitoring, not access forensics.

• ✗

  Access Transparency

  Why it's wrong here

  Access Transparency provides logs of actions that Google Cloud employees take on your resources, such as accessing customer data for support or troubleshooting. It does not capture actions performed by your own organization’s administrators via the Console or API — those are the domain of Cloud Audit Logs. Because the question asks about 'all actions performed by administra' (presumably your own admins), Access Transparency is the wrong scope and also does not cover API calls made with your credentials.

• ✗

  VPC Flow Logs

  Why it's wrong here

  VPC Flow Logs sample and record network traffic metadata — source and destination IPs, ports, protocols, and packet/byte counts — for network-level diagnostics and security analytics. They neither capture control-plane API calls nor the user identity behind administrative changes like creating a VM, modifying firewall rules, or changing IAM bindings. Thus they are highly useful for investigating network anomalies but are fundamentally not an admin-activity audit mechanism.

• ✓

  Cloud Audit Logs

  Why this is correct

  Cloud Audit Logs are the native audit trail for Google Cloud, capturing Admin Activity, Data Access, and System Event records that answer who performed an action, on what resource, when, and from where. Admin Activity logs are enabled by default and include all control-plane API calls, such as creating a project, updating IAM policies, or deleting a service — exactly the 'all actions performed by administrators' requirement. These logs are immutable and can be exported to Cloud Storage or BigQuery for long-term retention and compliance analysis.

Go deeper

Related to this question