Examkin

Question

Difficulty: MediumViewing and Analyzing Cloud Audit Logs

A junior security administrator needs permission to view standard Admin Activity audit logs within a specific Google Cloud project to investigate resource deletion events. To comply with security requirements, the administrator must not be able to view sensitive Data Access audit logs or modify Cloud Logging configurations. Following Google Cloud best practices for least privilege, which IAM role should be assigned to the administrator?

  1. Logs Viewer (roles/logging.viewer)Answer
  2. B
    Viewer (roles/viewer)
  3. C
    Private Logs Viewer (roles/logging.privateLogViewer)
  4. D
    Logging Admin (roles/logging.admin)

Answer

Assign the Logs Viewer (roles/logging.viewer) predefined role to the administrator.
The correct answer recommendation is the Logs Viewer (roles/logging.viewer) role. It allows users to view standard Admin Activity, System Event, and Access Transparency logs in Cloud Logging. It explicitly does not grant access to view sensitive Data Access logs (which require roles/logging.privateLogViewer) nor does it grant permission to alter log sinks or settings.

Step-by-Step Solution

1
Identify the specific log types required
The requirement requests viewing Admin Activity audit logs only.
Admin Activity logs record administrative writes and configuration changes.
2
Identify security restrictions
Access to Data Access logs must be restricted, and configuration modification permissions must be excluded.
Data Access audit logs contain API calls that read user-provided data and require the specialized Private Logs Viewer role.
3
Select the appropriate IAM role matching least privilege
Logs Viewer (roles/logging.viewer) permits reading standard audit logs while excluding private Data Access logs and logging administrative permissions.
Predefined logging roles separate standard log viewing from private log viewing and logging administrative actions.

Key Concept

IAM permission granularity for Cloud Audit Logs
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic