Audit logging in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Audit Log Types in GCP

Which of the following is NOT a standard audit log type provided by Google Cloud Platform?

A Admin Activity logs

B Data Access logs

C System Performance logs

D Policy Denied logs

💡 Hint

Think about the main categories of audit logs GCP provides for tracking user and system actions.

GCP provides Admin Activity, Data Access, and Policy Denied logs as standard audit logs. System Performance logs are not a standard audit log type.

💻 Command Output

intermediate

Output of Enabling Audit Logs for a Service

What is the output of the following gcloud command when successfully enabling audit logs for the Compute Engine API?

GCP

gcloud logging sinks create my-sink storage.googleapis.com/my-bucket --log-filter='resource.type="gce_instance"' --project=my-project

A ERROR: (gcloud.logging.sinks.create) Permission denied.

B Created sink [projects/my-project/sinks/my-sink].

C No sinks created. Invalid filter syntax.

D Sink already exists with the same name.

💡 Hint

Successful creation of a sink shows a confirmation message with the sink's full path.

The command creates a logging sink and outputs a confirmation message with the sink's full resource path.

❓ Configuration

advanced

Configuring Audit Log Exclusions

Which configuration snippet correctly excludes Data Access logs for BigQuery from being ingested into Cloud Logging?

A

{
  "name": "exclude-bigquery-data-access",
  "filter": "logName:bigquery.googleapis.com AND protoPayload.methodName:dataAccess",
  "description": "Exclude BigQuery Data Access logs",
  "disabled": true
}

B

{
  "name": "exclude-bigquery-data-access",
  "filter": "resource.type=bigquery_resource AND logName:dataAccess",
  "description": "Exclude BigQuery Data Access logs",
  "disabled": false
}

C

{
  "name": "exclude-bigquery-data-access",
  "filter": "logName:bigquery.googleapis.com/dataAccess",
  "description": "Exclude BigQuery Data Access logs",
  "disabled": false
}

D

{
  "name": "exclude-bigquery-data-access",
  "filter": "logName:bigquery.googleapis.com AND protoPayload.methodName:dataAccess",
  "description": "Exclude BigQuery Data Access logs",
  "disabled": false
}

💡 Hint

Check the filter syntax and ensure the exclusion is enabled.

Option D correctly uses the logName and protoPayload.methodName fields and sets disabled to false to enable exclusion.

❓ Troubleshoot

advanced

Troubleshooting Missing Audit Logs

You notice that Admin Activity audit logs for Cloud Storage are missing in Cloud Logging. Which of the following is the MOST likely cause?

A The Cloud Storage API is disabled in the project.

B Audit logs are only available for Compute Engine resources.

C The user has not enabled billing for the project.

D The logs are delayed by 24 hours before appearing.

💡 Hint

Audit logs require the service API to be enabled to generate logs.

If the Cloud Storage API is disabled, no audit logs for it will be generated. Audit logs are available for many services, not just Compute Engine.

🔀 Workflow

expert

Steps to Enable and Verify Audit Logging for a New Service

Arrange the steps in the correct order to enable audit logging for a new Google Cloud service and verify logs are generated.

A 1,3,2,4

B 2,1,3,4

C 1,2,3,4

D 3,1,2,4

💡 Hint

Think about enabling the service first, then generating logs, then exporting if needed, and finally verifying.

First enable the service API, then perform actions to generate logs, next configure sinks if exporting is needed, and finally verify logs in Cloud Logging.

Practice

1. What is the main purpose of audit logging in Google Cloud Platform?

easy

A. To create virtual machines

B. To record actions for security and troubleshooting

C. To speed up network traffic

D. To increase storage capacity automatically

Solution

1. Step 1: Understand audit logging function

   Audit logging captures user and system actions in your cloud environment.

2. Step 2: Identify the purpose

   This helps with security monitoring and troubleshooting issues.

3. Final Answer:

   To record actions for security and troubleshooting -> Option B

4. Quick Check:

   Audit logging = record actions [OK]

Hint: Audit logs track actions for security and fixes [OK]

Common Mistakes:

• Confusing audit logs with storage or network features
• Thinking audit logs create resources
• Assuming audit logs improve performance

2. Which command correctly creates a sink to export audit logs to a Cloud Storage bucket named my-logs-bucket?

easy

A. gcloud logging sinks create my-sink storage.googleapis.com/my-logs-bucket --log-filter="resource.type=\"gce_instance\""

B. gcloud logging create sink my-sink storage://my-logs-bucket

C. gcloud logs create sink my-sink gs://my-logs-bucket

D. gcloud logging sinks add my-sink storage.googleapis.com/my-logs-bucket

Solution

1. Step 1: Identify correct gcloud command syntax

   The correct command uses gcloud logging sinks create followed by sink name and destination URL.

2. Step 2: Verify destination format

   Cloud Storage buckets use storage.googleapis.com/BUCKET_NAME format.

3. Final Answer:

   gcloud logging sinks create my-sink storage.googleapis.com/my-logs-bucket --log-filter="resource.type=\"gce_instance\"" -> Option A

4. Quick Check:

   Correct sink creation syntax = gcloud logging sinks create my-sink storage.googleapis.com/my-logs-bucket --log-filter="resource.type=\"gce_instance\"" [OK]

Hint: Use 'gcloud logging sinks create' with full storage URL [OK]

Common Mistakes:

• Using wrong command verbs like 'create sink' or 'add sink'
• Incorrect bucket URL format (missing storage.googleapis.com)
• Using 'gs://' instead of full URL

3. Given this filter in a sink configuration: resource.type="bigquery_resource" AND protoPayload.methodName="jobservice.jobcompleted", what logs will be exported?

medium

A. Only logs from Compute Engine instances

B. All error logs from Cloud Storage

C. All BigQuery job completion audit logs

D. All network traffic logs

Solution

1. Step 1: Analyze the resource type filter

   The filter specifies resource.type="bigquery_resource", so logs relate to BigQuery.

2. Step 2: Analyze the method name filter

   protoPayload.methodName="jobservice.jobcompleted" means only job completion events are included.

3. Final Answer:

   All BigQuery job completion audit logs -> Option C

4. Quick Check:

   Filter matches BigQuery job completions = All BigQuery job completion audit logs [OK]

Hint: Filter resource and method to find exported logs [OK]

Common Mistakes:

• Confusing resource types with unrelated services
• Ignoring methodName filter
• Assuming all logs are exported

4. You created a sink to export audit logs to a Pub/Sub topic but logs are not appearing. What is the most likely cause?

medium

A. The sink lacks permission to publish to the Pub/Sub topic

B. The sink filter is too broad and excludes all logs

C. Audit logging is disabled in the project

D. The Pub/Sub topic name is misspelled in the sink

Solution

1. Step 1: Check sink permissions

   Sinks need permission to write to destinations like Pub/Sub topics.

2. Step 2: Identify common permission issue

   If logs do not appear, the sink likely lacks the pubsub.publisher role on the topic.

3. Final Answer:

   The sink lacks permission to publish to the Pub/Sub topic -> Option A

4. Quick Check:

   Missing sink permissions = The sink lacks permission to publish to the Pub/Sub topic [OK]

Hint: Check sink destination permissions first when logs missing [OK]

Common Mistakes:

• Assuming audit logging is off without checking
• Blaming filter without verifying permissions
• Ignoring typo in topic name

5. You want to export only admin activity audit logs for Cloud Storage buckets in your project to a BigQuery dataset for analysis. Which sink filter is correct?

hard

A. resource.type="gcs_bucket" AND severity="ERROR"

B. logName:"cloudaudit.googleapis.com/activity" AND resource.type="gcs_bucket" AND protoPayload.methodName:"storage.objects.create"

C. logName:"cloudaudit.googleapis.com/data_access" AND resource.type="gcs_bucket"

D. logName:"cloudaudit.googleapis.com/admin_activity" AND resource.type="gcs_bucket"

Solution

1. Step 1: Identify admin activity logs

   Admin activity logs use logName:"cloudaudit.googleapis.com/admin_activity".

2. Step 2: Filter for Cloud Storage buckets

   Use resource.type="gcs_bucket" to target storage buckets.

3. Step 3: Confirm filter matches requirement

   logName:"cloudaudit.googleapis.com/admin_activity" AND resource.type="gcs_bucket" correctly combines admin activity logs with GCS buckets.

4. Final Answer:

   logName:"cloudaudit.googleapis.com/admin_activity" AND resource.type="gcs_bucket" -> Option D

5. Quick Check:

   Admin activity + GCS bucket filter = logName:"cloudaudit.googleapis.com/admin_activity" AND resource.type="gcs_bucket" [OK]

Hint: Use admin_activity logName for admin logs [OK]

Common Mistakes:

• Using data_access logs instead of admin_activity
• Filtering by specific methods unnecessarily
• Confusing severity with log type