Data access logs in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Understanding Data Access Logs Activation

You enable Data Access logs for a Google Cloud Storage bucket. What is the expected behavior immediately after enabling these logs?

A Data Access logs only record write operations, not read operations.

B Data Access logs start recording all read and write operations on the bucket immediately.

C Data Access logs start recording only after 24 hours delay from enabling.

D Data Access logs are not generated unless Audit Logs API is explicitly called.

💡 Hint

Think about what Data Access logs are designed to capture in Google Cloud.

Data Access logs capture both read and write operations immediately after enabling, providing detailed audit information.

❓ security

intermediate

Permissions Required for Viewing Data Access Logs

Which IAM role is required for a user to view Data Access logs in Google Cloud's Cloud Logging?

A roles/audit.logReader

B roles/storage.objectViewer

C roles/logging.viewer

D roles/owner

💡 Hint

Consider which role grants read access to logs in Cloud Logging.

The roles/logging.viewer role allows users to read logs, including Data Access logs, in Cloud Logging.

❓ Architecture

advanced

Designing a Secure Audit Logging Architecture

You want to ensure Data Access logs for BigQuery are immutable and stored securely for compliance. Which architecture best achieves this?

A Export Data Access logs to a Cloud Storage bucket with Object Versioning and Bucket Lock enabled.

B Store Data Access logs only in Cloud Logging with default retention settings.

C Export Data Access logs to BigQuery and allow users to modify the logs as needed.

D Send Data Access logs to Pub/Sub and delete them after 30 days.

💡 Hint

Think about how to make logs tamper-proof and retained for compliance.

Exporting logs to Cloud Storage with Object Versioning and Bucket Lock ensures logs are immutable and retained securely.

❓ Configuration

advanced

Configuring Data Access Logs for Cloud SQL

Which configuration step is necessary to enable Data Access logs for Cloud SQL instances?

A Enable Data Access logs in Cloud Audit Logs settings and configure export to Cloud Logging.

B Enable SQL Insights and Data Access logs are automatically enabled.

C Set the Cloud SQL instance to private IP mode to activate Data Access logs.

D Create a custom IAM role with Cloud SQL Admin permissions to enable logs.

💡 Hint

Consider where Data Access logs are managed in Google Cloud.

Data Access logs are enabled via Cloud Audit Logs settings and can be exported to Cloud Logging for Cloud SQL.

✅ Best Practice

expert

Optimizing Cost and Retention for Data Access Logs

Your organization generates large volumes of Data Access logs daily. What is the best practice to optimize cost while retaining logs for 1 year?

A Disable Data Access logs and rely on System Event logs for auditing.

B Keep all Data Access logs only in Cloud Logging with default retention of 30 days.

C Export logs to BigQuery without partitioning and keep indefinitely.

D Export Data Access logs to Cloud Storage with Nearline storage class and set lifecycle to delete after 1 year.

💡 Hint

Think about storage classes and lifecycle policies for cost-effective long-term retention.

Using Cloud Storage Nearline with lifecycle policies balances cost and retention for large volumes of logs.