Cloud Digital Leader Trust and security with Google Cloud Practice Question

A company's security team wants to be alerted when someone with administrative permissions changes an IAM policy in their Google Cloud organization. Which Google Cloud capability enables this detection?

⚠ Common exam trap

The GCDL exam often tests the distinction between audit log types (Admin Activity vs. Data Access) and the specific services that handle control-plane vs. data-plane operations, leading candidates to mistakenly choose Data Access logs or VPC flow logs for IAM policy changes.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Admin Activity audit logs combined with Cloud Monitoring log-based alerting, which records and alerts on IAM policy modifications by any principal

Admin Activity audit logs record all changes to IAM policies and other configuration changes in Google Cloud. By combining these logs with Cloud Monitoring log-based alerting, the security team can create a specific alert that triggers whenever an IAM policy is modified by a principal with administrative permissions, enabling real-time detection of unauthorized changes.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Data Access audit logs, which record when data is read from Cloud Storage buckets
Why it's wrong here
Data Access audit logs capture data-plane operations such as reading or writing objects in Cloud Storage buckets, BigQuery queries, and other data access events. They do not record IAM policy or permission changes, because those are management-plane operations that appear in Admin Activity audit logs. Additionally, Data Access audit logs are disabled by default, whereas Admin Activity logs are always enabled, making them unsuitable for reliably detecting unauthorized IAM modifications.
✓
Admin Activity audit logs combined with Cloud Monitoring log-based alerting, which records and alerts on IAM policy modifications by any principal
Why this is correct
Admin Activity audit logs record all IAM policy changes (SetIamPolicy calls) automatically and cannot be disabled. A log-based metric in Cloud Monitoring can count these events, and an alerting policy triggers a notification whenever an IAM change is detected. This is the standard approach for IAM change monitoring.
✗
Cloud Armor, which blocks unauthorized IAM policy changes at the network layer
Why it's wrong here
Cloud Armor is a web application firewall and DDoS protection service that filters HTTP/S traffic at the network edge based on IP addresses, geo-location, and custom match conditions. It operates exclusively on network traffic directed at your applications and cannot inspect or intercept management-plane API calls such as SetIamPolicy, which are authenticated and processed through Google's IAM service. Therefore, Cloud Armor cannot block or log IAM policy changes regardless of their authorization status.
✗
VPC flow logs, which capture all network traffic including IAM API calls
Why it's wrong here
VPC flow logs capture network layer metadata—such as source IP, destination IP, protocol, and port—for connections passing through a VPC, but they do not record the packet payloads or the content of encrypted API requests. Because IAM API calls are made over HTTPS and the action (e.g., SetIamPolicy) resides in the TLS-encrypted body, flow logs cannot reveal that an IAM policy change occurred or who initiated it. They are designed for network telemetry, not for auditing application-level management operations.

Go deeper

Cloud Digital Leader Trust and security with Google Cloud Practice Question

Why each option matters

Option-by-option breakdown

Related to this question