Examkin

Question

Difficulty: MediumViewing and Analyzing Cloud Audit Logs

A cloud compliance engineer needs to extract audit records for all deleted Compute Engine virtual machine instances within a project named `prod-infrastructure`. The engineer wants to run a `gcloud logging read` command that targets only standard Admin Activity audit logs containing the API calls for instance deletion. Which filter expression should be passed to the command?

  1. logName="projects/prod-infrastructure/logs/cloudaudit.googleapis.com%2Factivity" AND protoPayload.methodName="v1.compute.instances.delete"Answer
  2. B
    logName="projects/prod-infrastructure/logs/cloudaudit.googleapis.com%2Fdata_access" AND protoPayload.methodName="v1.compute.instances.delete"
  3. C
    logName="projects/prod-infrastructure/logs/cloudaudit.googleapis.com%2Factivity" AND jsonPayload.methodName="v1.compute.instances.delete"
  4. D
    logName="organizations/prod-infrastructure/logs/cloudaudit.googleapis.com%2Factivity" AND resource.labels.method_name="v1.compute.instances.delete"

Answer

The filter expression `logName="projects/prod-infrastructure/logs/cloudaudit.googleapis.com%2Factivity" AND protoPayload.methodName="v1.compute.instances.delete"` correctly targets Admin Activity audit logs for VM instance deletions.
Admin Activity logs track administrative actions that modify GCP resources and are cataloged under `cloudaudit.googleapis.com/activity`. Cloud Logging structures audit entries within the `protoPayload` object, so filtering by `protoPayload.methodName="v1.compute.instances.delete"` accurately isolates Compute Engine deletion events.

Step-by-Step Solution

1
Identify the correct audit log type stream.
Resource administrative modifications (like deleting a VM instance) are captured under Admin Activity logs (`cloudaudit.googleapis.com/activity`), not Data Access logs.
Admin Activity logs are automatically generated for API calls that modify configuration or metadata of resources.
2
Determine the payload structure for Google Cloud Audit Logs.
Audit log details use the `protoPayload` schema, which contains standard fields such as `methodName`, `authenticationInfo`, and `serviceName`.
Cloud Audit Logs use Protocol Buffer-based AuditLog objects mapped to `protoPayload` in Cloud Logging.
3
Formulate the exact gcloud logging query filter.
Combine `logName="projects/prod-infrastructure/logs/cloudaudit.googleapis.com%2Factivity"` with `protoPayload.methodName="v1.compute.instances.delete"`.
This precisely restricts log retrieval to Compute Engine deletion events within the designated project.

Key Concept

Cloud Audit Logs Filtering and Payload Structure
Estimated Time:1m 15s
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic