Audit logging in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Audit Log Types in GCP

Which of the following is NOT a standard audit log type provided by Google Cloud Platform?

A Admin Activity logs

B Data Access logs

C System Performance logs

D Policy Denied logs

💡 Hint

Think about the main categories of audit logs GCP provides for tracking user and system actions.

GCP provides Admin Activity, Data Access, and Policy Denied logs as standard audit logs. System Performance logs are not a standard audit log type.

💻 Command Output

intermediate

Output of Enabling Audit Logs for a Service

What is the output of the following gcloud command when successfully enabling audit logs for the Compute Engine API?

GCP

gcloud logging sinks create my-sink storage.googleapis.com/my-bucket --log-filter='resource.type="gce_instance"' --project=my-project

A ERROR: (gcloud.logging.sinks.create) Permission denied.

B Created sink [projects/my-project/sinks/my-sink].

C No sinks created. Invalid filter syntax.

D Sink already exists with the same name.

💡 Hint

Successful creation of a sink shows a confirmation message with the sink's full path.

The command creates a logging sink and outputs a confirmation message with the sink's full resource path.

❓ Configuration

advanced

Configuring Audit Log Exclusions

Which configuration snippet correctly excludes Data Access logs for BigQuery from being ingested into Cloud Logging?

A

{
  "name": "exclude-bigquery-data-access",
  "filter": "logName:bigquery.googleapis.com AND protoPayload.methodName:dataAccess",
  "description": "Exclude BigQuery Data Access logs",
  "disabled": true
}

B

{
  "name": "exclude-bigquery-data-access",
  "filter": "resource.type=bigquery_resource AND logName:dataAccess",
  "description": "Exclude BigQuery Data Access logs",
  "disabled": false
}

C

{
  "name": "exclude-bigquery-data-access",
  "filter": "logName:bigquery.googleapis.com/dataAccess",
  "description": "Exclude BigQuery Data Access logs",
  "disabled": false
}

D

{
  "name": "exclude-bigquery-data-access",
  "filter": "logName:bigquery.googleapis.com AND protoPayload.methodName:dataAccess",
  "description": "Exclude BigQuery Data Access logs",
  "disabled": false
}

💡 Hint

Check the filter syntax and ensure the exclusion is enabled.

Option D correctly uses the logName and protoPayload.methodName fields and sets disabled to false to enable exclusion.

❓ Troubleshoot

advanced

Troubleshooting Missing Audit Logs

You notice that Admin Activity audit logs for Cloud Storage are missing in Cloud Logging. Which of the following is the MOST likely cause?

A The Cloud Storage API is disabled in the project.

B Audit logs are only available for Compute Engine resources.

C The user has not enabled billing for the project.

D The logs are delayed by 24 hours before appearing.

💡 Hint

Audit logs require the service API to be enabled to generate logs.

If the Cloud Storage API is disabled, no audit logs for it will be generated. Audit logs are available for many services, not just Compute Engine.

🔀 Workflow

expert

Steps to Enable and Verify Audit Logging for a New Service

Arrange the steps in the correct order to enable audit logging for a new Google Cloud service and verify logs are generated.

A 1,3,2,4

B 2,1,3,4

C 1,2,3,4

D 3,1,2,4

💡 Hint

Think about enabling the service first, then generating logs, then exporting if needed, and finally verifying.

First enable the service API, then perform actions to generate logs, next configure sinks if exporting is needed, and finally verify logs in Cloud Logging.