Examkin

Question

Difficulty: EasyViewing and Analyzing Cloud Audit Logs

A security administrator needs to grant an internal auditor permissions to view standard Admin Activity audit logs as well as Data Access audit logs containing sensitive data in Cloud Logging, using predefined roles that follow the principle of least privilege. Which TWO IAM roles should be assigned to the auditor? (Select two.)

  1. Logs Viewer (roles/logging.viewer)Answer
  2. Private Logs Viewer (roles/logging.privateLogViewer)Answer
  3. C
    Owner (roles/owner)
  4. D
    Organization Admin (roles/resourcemanager.organizationAdmin)

Answer

The correct roles to assign are Logs Viewer (roles/logging.viewer) and Private Logs Viewer (roles/logging.privateLogViewer).
Viewing standard Admin Activity audit logs requires the Logs Viewer role (roles/logging.viewer). Viewing sensitive Data Access audit logs requires the Private Logs Viewer role (roles/logging.privateLogViewer). Combining these two predefined roles provides full required visibility while respecting the principle of least privilege.

Step-by-Step Solution

1
Determine the predefined role required to view standard and Admin Activity logs.
Identify Logs Viewer (roles/logging.viewer) as the minimal predefined role for standard audit log access.
Admin Activity audit logs are accessible with standard log reading permissions.
2
Determine the predefined role required to view restricted Data Access audit logs.
Identify Private Logs Viewer (roles/logging.privateLogViewer) as the necessary role.
Data Access audit logs contain sensitive resource access information and require explicit private log viewing permissions.

Key Concept

Cloud Audit Logs IAM Permissions (Logs Viewer vs Private Logs Viewer)
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic