Audit logging in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the command to enable audit logging for a GCP project.

GCP

gcloud logging [1] create --project=my-project

Drag options to blanks, or click blank then click option'

Alogs

Bsinks

Cenable

Daudit

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'logs' instead of 'sinks' causes an unknown command error.

Using 'enable' or 'audit' are not valid subcommands here.

The gcloud logging sinks create command is used to create a sink, which can be used to export audit logs.

2fill in blank

medium

Complete the command to list audit logs in GCP.

GCP

gcloud logging [1] list --project=my-project

Drag options to blanks, or click blank then click option'

Aentries

Bsinks

Cmetrics

Dlogs

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'logs' lists log names, not entries.

Using 'sinks' or 'metrics' lists other resources, not logs.

The gcloud logging entries list command lists log entries, including audit logs.

3fill in blank

hard

Fix the error in the command to enable audit logging for BigQuery.

GCP

gcloud logging sinks create bigquery_sink bigquery.googleapis.com/projects/my-project/datasets/my_dataset --log-filter='resource.type=[1]' --project=my-project

Drag options to blanks, or click blank then click option'

Abigquery_resource

Bbigquery_table

Cbigquery_dataset

Dbigquery_project

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'bigquery_table' causes no logs to match the filter.

Using 'bigquery_project' or 'bigquery_resource' are invalid resource types.

The correct resource type for BigQuery audit logs is bigquery_dataset.

4fill in blank

hard

Fill both blanks to create a filter for audit logs of admin activity on Compute Engine.

GCP

resource.type=[1] AND protoPayload.methodName=[2]

Drag options to blanks, or click blank then click option'

Agce_instance

Bcompute.googleapis.com

Cv1.compute.instances.insert

Dgce_project

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'compute.googleapis.com' as resource type is incorrect.

Using 'gce_project' is not a valid resource type.

Using 'compute.instances.delete' would filter deletions, not creations.

The resource type for Compute Engine instances is gce_instance. The method name for creating instances is v1.compute.instances.insert.

5fill in blank

hard

Fill all three blanks to create a dictionary comprehension that maps log names to their creation timestamps, filtering logs with 'admin' in their name.

GCP

{ [1]: [2] for [3] in logs if 'admin' in [3] }

Drag options to blanks, or click blank then click option'

Alog.name

Blog.createTime

Clog

Dlogs

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'logs' as the loop variable causes errors.

Using 'log' as the key or value without attribute causes errors.

Using 'log.createTime' as key is incorrect.

We use log.name as the key, log.createTime as the value, and iterate over log in logs.