Examkin

Question

Difficulty: MediumViewing and Analyzing Cloud Audit Logs

A team of external compliance reviewers needs permission to inspect Admin Activity audit logs for a target Google Cloud project to verify infrastructure modification events. The reviewers must not be able to view sensitive Data Access audit logs containing user payloads, nor should they receive read or write permissions for project compute and storage resources. Following Google Cloud security best practices and the principle of least privilege, which IAM role configuration should be implemented?

  1. Grant the Logs Viewer (roles/logging.viewer) role to the compliance team directly on the target project.Answer
  2. B
    Grant the basic Viewer (roles/viewer) role to the compliance team directly on the target project.
  3. C
    Grant the Logs Viewer (roles/logging.viewer) role at the parent folder level, while revoking logging permissions on the target project.
  4. D
    Grant the basic Editor (roles/editor) role to the compliance team to allow log access through Cloud Logging APIs.

Answer

Grant the Logs Viewer (roles/logging.viewer) role to the compliance team directly on the target project.
Granting the predefined Logs Viewer (roles/logging.viewer) role on the project provides the exact permissions required to inspect Admin Activity logs, System Event logs, and Access Transparency logs. It explicitly excludes access to sensitive Data Access logs (which require Private Logs Viewer) and does not grant any read/write permissions to underlying GCP resources.

Step-by-Step Solution

1
Identify the required audit log visibility requirements.
The requirement specifies access to Admin Activity logs only, while strictly restricting access to Data Access audit logs and GCP resource states.
Admin Activity logs record administrative configuration actions and are accessible by default to log viewing roles, whereas Data Access logs require private log access.
2
Evaluate predefined Logging IAM roles against least privilege.
The Logs Viewer (roles/logging.viewer) role grants permission to view standard audit logs (Admin Activity) but excludes Data Access logs (which require roles/logging.privateLogViewer).
Selecting predefined roles scoped specifically to logging prevents granting unnecessary permissions to underlying infrastructure components.
3
Verify resource hierarchy inheritance rules.
Assigning the role at the target project level ensures exact scope boundary enforcement without triggering inherited access issues from parent folders or organization nodes.
Google Cloud IAM follows additive policy inheritance where parent permissions cannot be revoked at lower levels.

Key Concept

Least Privilege IAM Access for Cloud Audit Logs
Estimated Time:1m 30s
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic