Examkin

Question

Difficulty: MediumViewing and Analyzing Cloud Audit Logs

A security operations team requires access to analyze Google Cloud Audit Logs during incident response investigations. The analysts must be able to read both standard Admin Activity logs and sensitive Data Access audit logs across project resources. Which of the following IAM roles grant the necessary permissions to view Data Access audit logs in Cloud Logging? (Select TWO.)

  1. Private Logs Viewer (roles/logging.privateLogViewer)Answer
  2. Logging Admin (roles/logging.admin)Answer
  3. C
    Logs Viewer (roles/logging.viewer)
  4. D
    Viewer (roles/viewer)

Answer

The correct roles are Private Logs Viewer (roles/logging.privateLogViewer) and Logging Admin (roles/logging.admin).
Viewing Data Access audit logs requires permissions to read Private Logs (specifically logging.privateLogEntries.list). The Private Logs Viewer (roles/logging.privateLogViewer) role is explicitly designed for this purpose. Additionally, Logging Admin (roles/logging.admin) contains full administrative control and encompasses read permissions for all log categories, including Private Logs.

Step-by-Step Solution

1
Identify the audit log classification being requested.
The requirement specifies reading Data Access audit logs in addition to Admin Activity logs.
Data Access audit logs contain sensitive information and are categorized as Private Logs in Cloud Logging.
2
Evaluate IAM roles for log viewing capabilities.
Private Logs Viewer (roles/logging.privateLogViewer) explicitly grants access to Private Logs, and Logging Admin (roles/logging.admin) provides full administrative read/write access across all logging resources.
Standard roles like Logs Viewer and primitive Viewer lack the logging.privateLogEntries.list permission.

Key Concept

Cloud Audit Logs IAM Role Access Control
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic