Google PCA Designing for Security and Compliance Practice Question
A company uses Cloud KMS with CMEK to encrypt data stored in BigQuery. They need to audit who has used the encryption key and when. Which type of audit log should they enable?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Access audit logs
Cloud KMS operations (e.g., encrypt, decrypt) are recorded in Data Access audit logs. Admin Activity logs record configuration changes, not data access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network Security audit logs
Why it's wrong here
Network Security logs are not a standard GCP audit log category.
- ✗
Admin Activity audit logs
Why it's wrong here
Admin Activity logs record changes to resource configurations, not data access events like decrypt operations.
- ✗
System Event audit logs
Why it's wrong here
System Event logs record Google-managed events, not customer data access.
- ✓
Data Access audit logs
Why this is correct
Data Access logs capture who accessed data or performed cryptographic operations using Cloud KMS keys.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Cloud KMS
Cloud KMS (Key Management Service) is a cloud-based service that lets you create, manage, and use encryption keys to protect your data at rest and in transit.
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
About these practice questions
Courseiva writes every PCA question from scratch — 955 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.