Examkin

Question

Difficulty: HardViewing and Analyzing Cloud Audit Logs

An organization has configured Data Access audit logging for sensitive Cloud Storage buckets and BigQuery datasets in a security-restricted project. An internal auditor requires access to analyze both standard Admin Activity audit logs and Data Access audit logs. The auditor must not be given permissions to edit log sinks or manage logging configurations. Which TWO IAM predefined roles must be granted to the auditor to adhere to the principle of least privilege?

  1. Logs Viewer (roles/logging.viewer)Answer
  2. B
    Viewer (roles/viewer)
  3. Private Logs Viewer (roles/logging.privateLogViewer)Answer
  4. D
    Logging Admin (roles/logging.admin)

Answer

The auditor requires both Logs Viewer (roles/logging.viewer) and Private Logs Viewer (roles/logging.privateLogViewer) to view standard Admin Activity logs and sensitive Data Access audit logs under the principle of least privilege.
Viewing Admin Activity audit logs requires Logs Viewer (roles/logging.viewer), while viewing Data Access audit logs requires Private Logs Viewer (roles/logging.privateLogViewer). Combining these two predefined roles provides read access to all requested audit logs while maintaining least privilege.

Step-by-Step Solution

1
Identify the audit log types to be accessed.
The requirement specifies reading both Admin Activity audit logs and Data Access audit logs.
Admin Activity logs are standard logs accessible via default logging viewer roles, whereas Data Access audit logs require explicit private log viewing rights due to sensitive data payload potential.
2
Evaluate required permissions for reading standard audit logs.
Logs Viewer (roles/logging.viewer) grants access to read standard project logs and Admin Activity logs.
It provides necessary read access to Cloud Logging without allowing administrative modifications.
3
Evaluate required permissions for reading Data Access audit logs.
Private Logs Viewer (roles/logging.privateLogViewer) grants access to view private log entries such as Data Access logs.
By default, Logs Viewer does not grant permissions to inspect private Data Access log payloads.

Key Concept

Cloud Audit Logs access control requires distinguishing standard log viewing roles from Private Logs Viewer permissions for inspecting Data Access logs under least privilege.
Estimated Time:2m 0s
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic