Cloud Digital Leader Trust and security with Google Cloud Practice Question
A company has a requirement from their security auditor to demonstrate that all administrative actions performed in Google Cloud (such as creating VMs, modifying IAM policies, and deleting storage buckets) are logged and tamper-evident. Which Cloud Logging log type fulfills this requirement?
⚠ Common exam trap
Many candidates confuse Data Access audit logs (which require enabling and capture data-level operations) with Admin Activity audit logs (which are always-on and capture administrative actions), leading them to incorrectly select option A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Admin Activity audit logs — always-on, tamper-resistant logs of all administrative API calls.
Admin Activity audit logs are always-on, tamper-resistant logs that record all administrative API calls, such as creating VMs, modifying IAM policies, and deleting storage buckets. They cannot be disabled or modified by users, ensuring tamper-evident logging for security auditor requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Access audit logs — they capture all read and write operations.
Why it's wrong here
Data Access audit logs record API calls that read or modify customer data, like GCS object reads or Pub/Sub message pulls, but they are not enabled by default and must be explicitly turned on per service. Even when enabled, they generate enormous log volumes and focus on the data plane, not on resource management or configuration changes. Therefore, they do not capture the administrative API calls (creation, modification, deletion of resources) that constitute the audit trail needed for security and compliance.
- ✓
Admin Activity audit logs — always-on, tamper-resistant logs of all administrative API calls.
Why this is correct
Admin Activity audit logs are automatically enabled for all Google Cloud projects and cannot be disabled or deleted by any user, including project owners or Org admins. They record all control-plane API calls such as resource creation, modification, and deletion, along with the calling principal, the request parameters, and the response status. Because these logs are immutable and stored independently of user access, they provide a tamper-resistant, authoritative record that satisfies audit requirements.
- ✗
System Event audit logs — they capture all Google Cloud operations.
Why it's wrong here
System Event audit logs capture only automated actions that Google Cloud itself performs, such as automatic scaling, maintenance events, or scheduled shutdowns. They do not include API calls made by users or service accounts, so they fail to record the administrative actions that auditors are concerned with. Since they omit all control-plane operations initiated by principals, they are not a complete log of Google Cloud operations.
- ✗
Cloud Monitoring logs — they track all changes to monitored resources.
Why it's wrong here
Cloud Monitoring is a metrics-based observability service, not an audit log. It collects performance data such as CPU utilization, memory usage, and request latency from monitored resources, but it has no awareness of who performed an administrative action or what configuration changed. These monitoring logs are not tamper-resistant and do not provide the event-level details needed for compliance audits, so they cannot track all changes to monitored resources.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.