Examkin

Question

Difficulty: HardViewing and Analyzing Cloud Audit Logs

During a security incident investigation, a Cloud Operations Security Analyst needs to review Google Cloud Audit Logs to identify every instance where a user or service account read secret payloads from Secret Manager within project `prod-sec-vault`. The analyst wants to run a `gcloud logging read` command that strictly filters for Data Access audit logs generated by Secret Manager payload access methods, excluding Admin Activity logs and unrelated services. Which filter expression should the analyst pass to the command?

  1. logName="projects/prod-sec-vault/logs/cloudaudit.googleapis.com%2Fdata_access" AND protoPayload.serviceName="secretmanager.googleapis.com" AND protoPayload.methodName="google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion"Answer
  2. B
    logName="projects/prod-sec-vault/logs/cloudaudit.googleapis.com%2Factivity" AND protoPayload.serviceName="secretmanager.googleapis.com" AND protoPayload.methodName="google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion"
  3. C
    logName="projects/prod-sec-vault/logs/cloudaudit.googleapis.com%2Fsystem_event" AND resource.type="secretmanager.googleapis.com" AND protoPayload.methodName="AccessSecretVersion"
  4. D
    logName="projects/prod-sec-vault/logs/data_access" AND protoPayload.serviceName="secretmanager.googleapis.com" AND protoPayload.methodName="AccessSecretVersion"

Answer

The correct filter uses logName="projects/prod-sec-vault/logs/cloudaudit.googleapis.com%2Fdata_access" combined with protoPayload.serviceName="secretmanager.googleapis.com" and protoPayload.methodName="google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion".
The correct option targets the `cloudaudit.googleapis.com%2Fdata_access` log stream while specifying both the target API service (`secretmanager.googleapis.com`) and the specific RPC method (`...AccessSecretVersion`). In Google Cloud Observability, reading secret data triggers Data Access (DATA_READ) audit entries. Querying this precise log path and method provides an exact, noise-free result set of payload read operations.

Step-by-Step Solution

1
Identify the audit log classification required for reading secret values.
Accessing payload data (such as calling AccessSecretVersion) produces a DATA_READ Data Access log entry, stored under the log ID `cloudaudit.googleapis.com/data_access` (URL-encoded in filter strings as `cloudaudit.googleapis.com%2Fdata_access`).
Admin Activity logs only track configuration changes (e.g., creating or modifying secret metadata), while System Event logs record automated GCP system operations.
2
Evaluate the protoPayload fields for service and method identification.
The audit payload contains `protoPayload.serviceName` set to `secretmanager.googleapis.com` and `protoPayload.methodName` set to `google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion`.
Filtering specifically on these fields isolates secret reading operations from other Secret Manager API calls such as IAM policy queries or secret metadata updates.
3
Verify proper logName formatting for gcloud logging read filters.
The full log resource path must follow `projects/[PROJECT_ID]/logs/cloudaudit.googleapis.com%2F[LOG_TYPE]`.
Omitting the `cloudaudit.googleapis.com%2F` prefix causes Cloud Logging filter queries to return empty or invalid log matching sets.

Key Concept

Cloud Audit Logs Filtering and Log Stream Taxonomy
Estimated Time:2m 0s
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic