Examkin

Question

Difficulty: MediumViewing and Analyzing Cloud Audit Logs

A security analyst needs to review Cloud Audit Logs for a Google Cloud project to investigate access to sensitive data stored in Cloud Storage. The analyst must be able to view both standard logs and Data Access audit logs containing private log entries in the Logs Explorer, while adhering strictly to the principle of least privilege without granting access to project resources or administrative configurations. Which TWO IAM roles should be granted to the security analyst?

  1. Logs Viewer (roles/logging.viewer)Answer
  2. Private Logs Viewer (roles/logging.privateLogViewer)Answer
  3. C
    Project Viewer (roles/viewer)
  4. D
    Logs Configuration Writer (roles/logging.configWriter)

Answer

Granting Logs Viewer (roles/logging.viewer) and Private Logs Viewer (roles/logging.privateLogViewer) allows viewing both standard log entries and restricted Data Access audit logs following the principle of least privilege.
Viewing Data Access audit logs requires the `logging.privateLogEntries.list` permission provided by the Private Logs Viewer role, while standard logs Explorer features require the Logs Viewer role. Combining these two predefined roles ensures full visibility into Cloud Audit Logs under the principle of least privilege.

Step-by-Step Solution

1
Identify log access requirements
The scenario specifies viewing standard audit logs (Admin Activity) alongside restricted Data Access audit logs.
Data Access audit logs contain sensitive data access records and require elevated logging permissions beyond standard viewer roles.
2
Select predefined IAM logging roles for audit access
Combine the Logs Viewer role for standard logs with the Private Logs Viewer role for Data Access audit logs.
The Logs Viewer role provides access to standard logs, while the Private Logs Viewer role explicitly grants the `logging.privateLogEntries.list` permission required for Data Access logs.
3
Validate against least privilege guidelines
Avoid broad primitive roles like Project Viewer or administrative roles like Logs Configuration Writer.
Predefined logging roles ensure necessary visibility into log entries without exposing underlying GCP resource contents or log management configurations.

Key Concept

Cloud Audit Log Access and Least Privilege IAM Roles
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic