Google PCA Designing for Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Data Access audit logs

  Why it's wrong here

  Data Access audit logs record reads and writes of user data, such as reading object contents, not administrative resource operations. They are tempting because they are disabled by default and can be enabled broadly, but create and delete instance calls are Admin Activity events.

• ✓

  Admin Activity audit logs

  Why this is correct

  Admin Activity audit logs capture permanent metadata writes such as instance creation and deletion, and are always enabled with 400-day retention, satisfying the 90-day requirement. Data Access logs record reads and are disabled by default, so they cannot reliably supply this Compute Engine administrative history.

• ✗

  System Event audit logs

  Why it's wrong here

  System Event audit logs capture Google-initiated actions such as live migration and host maintenance, not user-driven API calls. They are tempting because they are audit logs, but create and delete operations on instances are Admin Activity events, which is the correct log type here.

• ✗

  Policy Denied audit logs

  Why it's wrong here

  Policy Denied audit logs record only requests rejected by a security policy such as VPC Service Controls; successful create and delete operations never appear there. They are tempting when investigating blocked traffic, but the admin needs a complete record of instance lifecycle operations.

Go deeper

Related to this question