Exam Associate Cloud Engineer topic 1 question 113 discussion

Correct Answer is (B): Background Google Cloud provides Cloud Audit Logs, which is an integral part of Cloud Logging. It consists of two log streams for each project: Admin Activity and Data Access. Admin Activity logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. Admin Activity logs are always enabled. There is no charge for your Admin Activity audit logs. Data Access logs record API calls that create, modify, or read user-provided data. Data Access audit logs are disabled by default because they can be large. logging.viewer: The logging.viewer role gives the security admin team the ability to view the Admin Activity logs. logging.privateLogViewer : The logging.privateLogViewer role gives the ability to view the Data Access logs.

for me B is the correct answer..

n this scenario, virtual machines in the web-applications project need access to BigQuery datasets in the crm-databases-proj project.

There is no need to export logs to Cloud Storage for the auditor to review them unless there's a specific requirement or preference for reviewing them outside the GCP environment. The Logging service provides the necessary tools for log viewing and querying within the console. Directing the auditor to review logs for changes to Cloud IAM policy is part of their duties to ensure that the IAM policies have been correctly managed and modified. This does not require a separate permission as the privateLogViewer role already provides the necessary access.

The correct answer is B

No logs in cloud storage since reviewer won't have access to it

- The Logs Viewer role (roles/logging.viewer) gives you read-only access to Admin Activity, Policy Denied, and System Event audit logs. If you have just this role, you cannot view Data Access audit logs that are in the _Default bucket. - The Private Logs Viewer role(roles/logging.privateLogViewer) includes the permissions contained in roles/logging.viewer, plus the ability to read Data Access audit logs in the _Default bucket. Therefore, no need to export logs to Cloud storage explicitly, the _Default bucket sink access is already provided from the above role. https://cloud.google.com/iam/docs/audit-logging#audit_log_permissions

b is the correect answer

B. Assign the auditor the IAM role roles/logging.privateLogViewer. Direct the auditor to also review the logs for changes to Cloud IAM policy.

This answer is similar to answer choice B, but it suggests creating a custom role for the auditor that includes the "logging.privateLogEntries.list" permission. While this would provide the auditor with access to the necessary logs, directing them to also review Cloud IAM policy logs is not relevant to their request. Therefore, this answer is also not correct.

Correct Ans: B

I also think B

B is right. Similar practice question in tutorials dojo

B is correct ans

B is the correct answer

Correct Answer is (B)

Correct Answer is B.