Log Explorer and queries in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Understanding Log Explorer Query Output

You run this Log Explorer query in Google Cloud Platform:

resource.type = "gce_instance"
severity = "ERROR"
"disk"

What will the query return?

A All log entries from Compute Engine instances regardless of severity that mention the word 'disk'.

B All log entries from any resource with severity ERROR that mention the word 'disk'.

C All log entries from Compute Engine instances with severity ERROR that mention the word 'disk'.

D All log entries from Compute Engine instances with severity ERROR but excluding those mentioning 'disk'.

💡 Hint

Look at the resource type and severity filters carefully.

The query filters logs to only those from Compute Engine instances (resource.type = "gce_instance") with severity ERROR and containing the word 'disk'.

🧠 Conceptual

intermediate

Log Explorer Query Syntax for Time Filtering

Which of these Log Explorer queries correctly filters logs from the last 24 hours?

A timestamp >= timestamp_sub(current_timestamp(), interval 24 hour)

B timestamp >= "-24h"

C timestamp >= "2024-04-25T00:00:00Z"

D timestamp >= "2024-04-26T00:00:00Z"

💡 Hint

Log Explorer supports relative time syntax like '-24h'.

Log Explorer supports relative time strings like '-24h' in queries. SQL-like functions are not valid, and fixed timestamps do not generally represent 'last 24 hours' without knowing the current time.

❓ Configuration

advanced

Correct Query to Extract HTTP Status Codes

You want to find all HTTP request logs with status code 500 in Log Explorer. Which query is correct?

A httpRequest.status = 500

B protoPayload.status = 500

C jsonPayload.status = 500

D status = 500

💡 Hint

HTTP request logs use a specific field for status codes.

The field httpRequest.status contains the HTTP status code in GCP logs. Other fields are incorrect or do not exist for this purpose.

❓ security

advanced

Detecting Unauthorized Access Attempts Using Log Explorer

Which Log Explorer query best detects unauthorized access attempts to Cloud Storage buckets?

A resource.type = "gcs_bucket" AND protoPayload.status.code = 7

B resource.type = "gcs_bucket" AND protoPayload.status.code = 16

C resource.type = "gcs_bucket" AND protoPayload.authenticationInfo.principalEmail = "[e-mail]"

D resource.type = "gcs_bucket" AND severity = "ERROR"

💡 Hint

Look for the status code that means permission denied.

Status code 7 means 'PERMISSION_DENIED' in GCP logs, which indicates unauthorized access attempts.

✅ Best Practice

expert

Optimizing Log Explorer Queries for Performance

You have a large volume of logs. Which query practice improves Log Explorer performance the most?

A Use wildcard characters (*) in text search to match all patterns.

B Use only text search terms without filters to catch all logs.

C Use OR conditions extensively to include many log types.

D Use resource.type and severity filters before text search terms.

💡 Hint

Filtering by structured fields first reduces data scanned.

Filtering by resource.type and severity first narrows logs quickly, improving query speed and reducing cost.