Examkin

Question

Difficulty: HardViewing and Analyzing Cloud Audit Logs

An enterprise security compliance reviewer needs to inspect Cloud Audit Logs for sensitive Compute Engine operations within a Google Cloud project named core-infrastructure-prod. The reviewer currently holds the predefined Logs Viewer (roles/logging.viewer) role at the project level. While they can inspect Admin Activity audit logs, they are unable to view sensitive payload details within Data Access audit logs. Following the principle of least privilege, which action will allow the reviewer to view the Data Access audit logs?

  1. Grant the reviewer the Private Logs Viewer (roles/logging.privateLogViewer) role at the project level.Answer
  2. B
    Grant the reviewer the primitive Viewer (roles/viewer) role at the project level.
  3. C
    Grant the reviewer the Logs Viewer (roles/logging.viewer) role at the parent Organization level.
  4. D
    Grant the reviewer the primitive Editor (roles/editor) role at the project level.

Answer

Grant the reviewer the Private Logs Viewer (roles/logging.privateLogViewer) role at the project level.
In Google Cloud Logging, Data Access audit logs contain detailed API calls and sensitive payload data. The standard Logs Viewer (roles/logging.viewer) role allows viewing Admin Activity logs and standard logs, but access to private logs (which include Data Access audit logs) requires the Private Logs Viewer (roles/logging.privateLogViewer) role. Assigning this role follows the principle of least privilege.

Step-by-Step Solution

1
Identify the missing log access level.
The reviewer holds roles/logging.viewer, which grants permission to read standard logs and Admin Activity logs, but not private logs such as Data Access logs with restricted payloads.
Data Access audit logs often contain sensitive data or user information and are classified as private logs in Cloud Logging.
2
Evaluate IAM roles for least-privilege private log access.
The Private Logs Viewer (roles/logging.privateLogViewer) role specifically grants permission to view private logs, including Data Access audit log entries.
Assigning roles/logging.privateLogViewer satisfies the operational requirement without granting unnecessary management or primitive privileges.

Key Concept

Cloud Audit Logs access control requires the Private Logs Viewer role to read Data Access logs containing sensitive metadata.
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic