Examkin

Question

Difficulty: MediumViewing and Analyzing Cloud Audit Logs

An internal investigation team needs to analyze Cloud Audit Logs for a critical Google Cloud project. The team members require read-only access to inspect both standard Admin Activity logs (such as resource creation and configuration changes) and sensitive Data Access audit logs (such as object reads in Cloud Storage) within Logs Explorer. To adhere strictly to the principle of least privilege, which predefined IAM roles must be assigned to the team? (Select TWO answers.)

  1. Logs Viewer (roles/logging.viewer)Answer
  2. Private Logs Viewer (roles/logging.privateLogViewer)Answer
  3. C
    Logging Admin (roles/logging.admin)
  4. D
    Viewer (roles/viewer)

Answer

The correct roles are Logs Viewer (roles/logging.viewer) and Private Logs Viewer (roles/logging.privateLogViewer).
Viewing standard Admin Activity audit logs requires Logs Viewer (roles/logging.viewer), while inspecting sensitive Data Access logs requires Private Logs Viewer (roles/logging.privateLogViewer). Combining these two specific predefined roles satisfies both viewing requirements without granting administrative or broad resource access.

Step-by-Step Solution

1
Identify the requirement for standard Admin Activity log inspection in Logs Explorer.
Assigning Logs Viewer (roles/logging.viewer) allows users to view standard log entries, including Admin Activity logs.
Standard audit logs do not contain private user payload data and are accessible via standard log viewing roles.
2
Identify the requirement for sensitive Data Access audit log inspection.
Assigning Private Logs Viewer (roles/logging.privateLogViewer) enables permission to view Data Access audit logs.
Data Access audit logs are explicitly restricted to prevent unauthorized viewing of sensitive read operations and require private log viewing privileges.
3
Evaluate least privilege against broader or administrative roles.
Avoid granting primitive Viewer or administrative roles like Logging Admin.
Administrative roles grant unnecessary write and configuration capabilities, while primitive roles grant excessive visibility into non-logging services.

Key Concept

Cloud Audit Logs access control requires combining Logs Viewer for standard Admin Activity logs and Private Logs Viewer for sensitive Data Access logs under least privilege.
Estimated Time:1m 30s
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic