Managing Implementation and Ensuring Solution and Operations Reliability →hardMultiple ChoiceObjective-mapped
Google PCA Practice Question: Managing Implementation and Ensuring Solution and Operations Reliability
Your organization uses Cloud Logging to collect logs from all GCP projects. The security team wants to be alerted when a specific IAM policy change (e.g., granting roles/compute.admin to a user) occurs in any project. They need near real-time notification via email and a ticketing system. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a log-based alert in Cloud Logging with a filter for SetIamPolicy and configure a Pub/Sub notification channel. Use a Cloud Function subscribed to that topic to create a ticket in the ticketing system.
Log-based alerts in Cloud Logging can monitor logs for a specific filter (e.g., protoPayload.methodName=SetIamPolicy) and send notifications to multiple channels (email, Pub/Sub). Pub/Sub can then trigger a Cloud Function to create a ticket. Alerting policies can also use log-based metrics. Cloud Audit Logs logs IAM changes. The correct approach is to create a log-based alert with a Pub/Sub notification channel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a log-based alert in Cloud Logging with a filter for SetIamPolicy and configure a Pub/Sub notification channel. Use a Cloud Function subscribed to that topic to create a ticket in the ticketing system.
Why this is correct
Log-based alerts can directly send to Pub/Sub; the Cloud Function can create a ticket. Email can also be added as another channel.
- ✗
Use Cloud Asset Inventory to monitor IAM policy changes and set up a notification to Pub/Sub.
Why it's wrong here
Cloud Asset Inventory monitors asset changes but is not designed for near real-time alerts; it has a delay.
- ✗
Export all logs to BigQuery and run a scheduled query every hour to detect changes. If found, send an email using Cloud Scheduler.
Why it's wrong here
This is not near real-time (hourly) and complex.
- ✗
Create a Cloud Monitoring alert policy based on a metric from the Cloud Audit Logs, with email and SMS notifications.
Why it's wrong here
Alert policies can use logs, but log-based alerts are more direct for log content. However, this can work with a log-based metric. But SMS is not a ticketing system.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
Key term
Project
A project is a temporary endeavor with a defined beginning and end, undertaken to create a unique product, service, or result, managed through specific processes in IT environments.
About these practice questions
This PCA question is part of Courseiva's 955-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.