Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 1521Question →

An operations team needs to monitor custom error codes appearing in container log entries from a Google Kubernetes Engine (GKE) cluster. Whenever the rate of these specific error logs exceeds a critical threshold, the system must trigger an alert that sends notifications to an external incident management platform via an HTTP endpoint. Which TWO actions must the operations team take to configure this solution?

Select all that apply

Show answer & explanation

Answer: Create a log-based metric in Cloud Logging filtered by the specific container log fields and error patterns.; Configure an alerting policy in Cloud Monitoring that monitors the log-based metric and routes notifications through a Webhook notification channel.

Answer

To alert on specific container log patterns and notify an external HTTP endpoint, you must create a log-based metric in Cloud Logging to extract the count of matching log entries, and then create an Alerting Policy in Cloud Monitoring based on that metric using a Webhook notification channel.
The correct approach requires converting unstructured or structured log events into quantifiable metric data using a Cloud Logging log-based metric. Once the log-based metric is populated in Cloud Monitoring, an Alerting Policy can monitor its rate of occurrence and trigger alerts sent via a Webhook notification channel to external endpoints.

Step-by-Step Solution

1
Define a Log-based Metric in Cloud Logging
Filter container stdout/stderr logs by specific error attributes and convert matching entry frequencies into a numerical metric time-series.
Cloud Monitoring alerting policies require structured metric data to evaluate threshold conditions.
2
Configure Alerting Policy and Notification Channel in Cloud Monitoring
Set up an alerting condition against the log-based metric and link a Webhook notification channel pointing to the incident management platform.
When the metric condition triggers, Cloud Monitoring formats the alert payload and sends an HTTP POST request to the configured webhook URL.

Key Concept

Log-Based Metrics and Alerting Policies
Estimated Time:1m 30s
Question 1522Question →

A DevOps engineer is configuring Customer-Managed Encryption Keys (CMEK) in Google Cloud KMS for a Cloud Storage bucket that stores database backups. Corporate security policy mandates strict separation of duties: the Cloud Storage service agent must only be able to perform encryption and decryption operations with the key, while the security operations team must manage key lifecycle and IAM access policies without having permission to encrypt or decrypt data. Which TWO actions should be performed to satisfy these requirements?

Select all that apply

Show answer & explanation

Answer: Grant the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the specific CryptoKey.; Grant the security operations team the Cloud KMS Admin role (roles/cloudkms.admin) on the CryptoKey or Key Ring.

Answer

To enforce separation of duties, grant the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the specific CryptoKey, and grant the security operations team the Cloud KMS Admin role (roles/cloudkms.admin) on the CryptoKey or Key Ring.
Enforcing separation of duties in Cloud KMS requires granting functional roles to separate identities: `roles/cloudkms.cryptoKeyEncrypterDecrypter` provides data access permissions specifically to the Cloud Storage service agent, while `roles/cloudkms.admin` provides administrative key management permissions to the security operations team without allowing them to decrypt stored data.

Step-by-Step Solution

1
Identify the data access requirements for the service account performing encryption/decryption operations.
The Cloud Storage service agent requires the predefined role `roles/cloudkms.cryptoKeyEncrypterDecrypter` on the key.
This allows the service agent to encrypt and decrypt bucket objects without granting administrative control over key management.
2
Identify the administrative requirements for key management without data access.
The security team requires `roles/cloudkms.admin` on the Key Ring or CryptoKey.
This role grants lifecycle and IAM management rights but does not contain `cloudkms.cryptoKeyVersions.useToEncrypt` or `cloudkms.cryptoKeyVersions.useToDecrypt` permissions.

Key Concept

Separation of Duties in Cloud KMS IAM Roles
Estimated Time:1m 30s
Question 1523Question →

A DevOps team manages a fleet of Compute Engine Linux virtual machines running a custom application. They need to collect both guest operating system metrics (such as memory usage) and custom application log files located at `/var/log/app/*.log`, sending all telemetry to Google Cloud Observability. Which procedure is the Google-recommended approach to satisfy these operational requirements?

Show answer & explanation

Answer: Install the Google Cloud Ops Agent on the virtual machines, and configure a custom log receiver in the agent's configuration file to track the application log path.

Answer

Install the Google Cloud Ops Agent on the virtual machines, and configure a custom log receiver in the agent's configuration file to track the application log path.
The Google Cloud Ops Agent is the recommended unified telemetry collection agent for Compute Engine virtual machines. It collects both system metrics (such as memory and disk usage) and logs. Custom log paths can be ingested by adding a file receiver to the agent configuration file.

Step-by-Step Solution

1
Identify telemetry collection capabilities
Recognize that guest OS metrics (memory, disk swap) and custom file-based application logs are not available by default to Cloud Monitoring/Logging without guest telemetry software.
Compute Engine hypervisors only capture external VM metrics like CPU utilization and network throughput.
2
Select the correct agent
Choose the Google Cloud Ops Agent as the current unified agent for Compute Engine instances.
The Ops Agent combines logging and metric collection into a single agent, replacing legacy Stackdriver agents.
3
Configure custom log pipeline
Define a log receiver of type `files` in `/etc/google-cloud-ops-agent/config.yaml` specifying `/var/log/app/*.log`.
The Ops Agent requires explicit file path configurations to ingest non-standard application logs.

Key Concept

Google Cloud Ops Agent configuration for Compute Engine telemetry collection
Question 1524Question →

A security engineer needs to configure a dedicated user-managed service account for an application that publishes telemetry data to Google Cloud Pub/Sub. To satisfy security policies prohibiting long-lived JSON keys, the developer group (`[email protected]`) must be granted access to test the application by impersonating the service account. Place the operational steps in the correct sequence to complete this configuration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with creating the service account identity, assigning the Pub/Sub Publisher role to the service account, granting the Service Account Token Creator role to the developer group on the service account resource, and finally running test commands using the impersonation flag.
The logical and operational dependency order requires establishing the service account identity first. Second, functional workload access (`roles/pubsub.publisher`) is granted to the service account so it can interact with Pub/Sub. Third, security governance is enforced by granting the developer group the `roles/iam.serviceAccountTokenCreator` role specifically on the service account resource, enabling keyless short-lived credential generation. Fourth, developers can invoke commands using `--impersonate-service-account` to execute actions as the service account.

Step-by-Step Solution

1
Provision the service account identity
Service account `telemetry-pub-sa@<project-id>.iam.gserviceaccount.com` is registered in IAM.
An identity must exist in IAM before any IAM policies or role bindings can reference it.
2
Assign resource permissions to the service account
The service account holds `roles/pubsub.publisher` access.
The service account requires functional permissions to publish messages to the Google Cloud Pub/Sub topic.
3
Delegate impersonation permissions to the developer principal
Developers obtain `roles/iam.serviceAccountTokenCreator` on the service account resource.
Granting the Service Account Token Creator role on the specific service account allows developers to request short-lived credentials without exporting static JSON keys.
4
Run client tooling with impersonation
The CLI requests short-lived credentials and executes the Pub/Sub operations as the service account.
The `--impersonate-service-account` flag leverages the user's Token Creator role to automatically generate temporary tokens during execution.

Key Concept

Creating User-Managed Service Accounts and Configuring Impersonation via Service Account Token Creator
Estimated Time:1m 30s
Question 1525Question →

A security operations team requires access to analyze Google Cloud Audit Logs during incident response investigations. The analysts must be able to read both standard Admin Activity logs and sensitive Data Access audit logs across project resources. Which of the following IAM roles grant the necessary permissions to view Data Access audit logs in Cloud Logging? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Private Logs Viewer (roles/logging.privateLogViewer); Logging Admin (roles/logging.admin)

Answer

The correct roles are Private Logs Viewer (roles/logging.privateLogViewer) and Logging Admin (roles/logging.admin).
Viewing Data Access audit logs requires permissions to read Private Logs (specifically logging.privateLogEntries.list). The Private Logs Viewer (roles/logging.privateLogViewer) role is explicitly designed for this purpose. Additionally, Logging Admin (roles/logging.admin) contains full administrative control and encompasses read permissions for all log categories, including Private Logs.

Step-by-Step Solution

1
Identify the audit log classification being requested.
The requirement specifies reading Data Access audit logs in addition to Admin Activity logs.
Data Access audit logs contain sensitive information and are categorized as Private Logs in Cloud Logging.
2
Evaluate IAM roles for log viewing capabilities.
Private Logs Viewer (roles/logging.privateLogViewer) explicitly grants access to Private Logs, and Logging Admin (roles/logging.admin) provides full administrative read/write access across all logging resources.
Standard roles like Logs Viewer and primitive Viewer lack the logging.privateLogEntries.list permission.

Key Concept

Cloud Audit Logs IAM Role Access Control
Question 1526Question →

An organization requires an application service account residing in Project A to encrypt and decrypt sensitive application data using a Customer-Managed Encryption Key (CMEK) hosted in a central Cloud KMS project (Project B). The application service account must adhere to the principle of least privilege and must not possess permissions to create key versions, manage key ring permissions, or destroy keys. How should the cloud administrator configure IAM access for the service account in Project B?

Show answer & explanation

Answer: Grant the application service account the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) directly on the target CryptoKey in Project B.

Answer

Grant the application service account the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) directly on the target CryptoKey in Project B.
Granting the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the specific key provides the minimal set of permissions required to encrypt and decrypt data without allowing key administrative actions or project-level modification rights.

Step-by-Step Solution

1
Identify the specific functional requirement for the application service account.
The service account needs only to encrypt and decrypt data using a specific Cloud KMS key in Project B.
Security compliance requires adhering strictly to the principle of least privilege.
2
Select the appropriate IAM predefined role for Cloud KMS operations.
The Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) provides cryptographic execution permissions (cloudkms.cryptoKeyVersions.useToEncrypt and cloudkms.cryptoKeyVersions.useToDecrypt) without administrative rights.
Admin roles or broad primitive roles grant excessive privileges such as key management or resource creation.
3
Apply the IAM role at the narrowest scope (the target CryptoKey in Project B).
The service account in Project A gains access to perform cryptographic operations on the designated key in Project B.
Google Cloud IAM allows cross-project role bindings directly on Cloud KMS resources.

Key Concept

Cloud KMS Predefined IAM Roles and Least Privilege Access Control
Question 1527Question →

A platform team lead needs to grant a Site Reliability Engineering (SRE) team member permission to view standard Admin Activity audit logs in Cloud Logging for a GCP project. The team member must not be allowed to view Data Access audit logs containing sensitive information, nor should they be able to create log sinks or modify logging configurations. Following Google Cloud's principle of least privilege, which IAM role should be assigned to the team member?

Show answer & explanation

Answer: Logs Viewer (roles/logging.viewer)

Answer

Logs Viewer (roles/logging.viewer)
The Logs Viewer role (roles/logging.viewer) provides read-only permissions to view standard logs, including Admin Activity audit logs, but does not grant access to private logs (Data Access audit logs) or administrative permissions to modify log routing sinks.

Step-by-Step Solution

1
Analyze the access requirement
The user needs to view standard Admin Activity audit logs only.
Admin Activity logs record API calls or admin actions modifying resource configurations.
2
Evaluate restrictions against candidate roles
Access must explicitly exclude private Data Access logs and configuration permissions like log sink creation.
Principle of least privilege dictates granting only the minimum necessary permissions for the role.
3
Select the appropriate predefined IAM role
Logs Viewer (roles/logging.viewer) grants access to standard logs and Admin Activity logs while excluding private logs and admin actions.
This precisely matches the security requirement without over-privileging the user.

Key Concept

IAM Roles for Viewing Cloud Audit Logs under Least Privilege
Estimated Time:1m 30s
Question 1528Question →

A deployment script needs to provision a dedicated user-managed service account named `data-processor-sa` in project `finance-analytics` and grant it read-only access to objects inside a specific Cloud Storage bucket `gs://finance-raw-data`. Following Google Cloud security best practices and the principle of least privilege, which sequence of `gcloud` commands should be executed to create the service account and assign the required access?

Show answer & explanation

Answer: gcloud iam service-accounts create data-processor-sa --display-name="Data Processor SA"
gcloud storage buckets add-iam-policy-binding gs://finance-raw-data --member="serviceAccount:[email protected]" --role="roles/storage.objectViewer"

Answer

Create the service account using 'gcloud iam service-accounts create' and then grant object read permissions on the bucket using 'gcloud storage buckets add-iam-policy-binding' with the 'roles/storage.objectViewer' role.
Creating the service account establishes an identity for the workload. Granting the 'roles/storage.objectViewer' role directly on the specific Cloud Storage bucket 'gs://finance-raw-data' provides exact read access to objects without exposing other resources or project-level configurations.

Step-by-Step Solution

1
Create the dedicated user-managed service account
The identity '[email protected]' is provisioned.
Applications and deployment scripts should use dedicated user-managed service accounts rather than default compute identities.
2
Bind the minimum necessary IAM role at the bucket level
The service account gains read-only access strictly on 'gs://finance-raw-data'.
Applying the predefined role 'roles/storage.objectViewer' directly on the target resource adheres to the principle of least privilege.

Key Concept

Creating service accounts and binding predefined IAM roles at the resource level.
Estimated Time:1m 30s
Question 1529Question →

A security administration team needs to perform an immediate manual key rotation for a customer-managed key stored in Google Cloud KMS due to a updated corporate compliance policy. The team must ensure that new data is encrypted using the updated key version, existing data can still be decrypted, and least privilege IAM access is maintained without granting administrative control over the key ring. Which of the following actions should you perform to meet these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Create a new CryptoKeyVersion under the existing CryptoKey and set it as the primary version.; Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to application service accounts requiring data access instead of primitive roles.

Answer

To perform manual rotation while preserving decryption capabilities and least-privilege security, create a new CryptoKeyVersion and set it as primary, and assign the predefined Cloud KMS CryptoKey Encrypter/Decrypter role to application service accounts.
Creating a new key version and making it primary enables manual key rotation while keeping older versions active for decrypting previously encrypted data. Combining this with the predefined Cloud KMS CryptoKey Encrypter/Decrypter role ensures service accounts have only the cryptographic capabilities required for application workloads without administrative control over key resources.

Step-by-Step Solution

1
Perform key rotation in Cloud KMS
A new CryptoKeyVersion is added and designated as the primary version.
Setting the new version as primary forces new encrypt requests to use the updated key version while retaining older key versions so existing ciphertext can still be decrypted.
2
Configure least-privilege access control
Application service accounts receive the Cloud KMS CryptoKey Encrypter/Decrypter role.
This predefined role limits permissions specifically to cryptographic operations without exposing administrative functions or granting excessive broad permissions.

Key Concept

Cloud KMS Key Rotation and IAM Least Privilege
Question 1530Question →

A cloud security engineer needs to stream all Identity and Access Management (IAM) policy change audit logs from a Google Cloud project to a BigQuery dataset for long-term compliance analysis. In what sequential order should the engineer perform the steps to configure the Cloud Logging sink and grant the minimum necessary permissions for log streaming?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence requires creating the destination BigQuery dataset first, configuring the Cloud Logging sink to point to the dataset, retrieving the sink's generated writer identity service account, and finally granting that service account the BigQuery Data Editor role on the dataset.
Log export in GCP follows a strict dependency workflow. First, the destination resource (the BigQuery dataset) must exist. Second, creating the log sink produces a dedicated service account known as the writer identity. Third, the administrator must retrieve this identity string. Fourth, the administrator grants that writer identity permission (such as BigQuery Data Editor) directly on the target dataset. This ensures proper log routing under the principle of least privilege.

Step-by-Step Solution

1
Create the destination BigQuery dataset.
A target BigQuery dataset is created in the project to hold incoming log tables.
Log sinks require a pre-existing destination path upon creation.
2
Configure the Cloud Logging log sink targeting the BigQuery dataset.
The sink is established and Google Cloud automatically generates a unique service account (writer identity).
Creating the sink specifies what audit logs to filter and triggers identity generation.
3
Copy the generated writer identity service account identifier.
The exact service account email assigned to the sink is identified.
Permissions must be assigned to this specific identity to authorize log writing.
4
Grant the writer identity the BigQuery Data Editor role on the dataset.
Log entries begin streaming successfully from Cloud Logging into BigQuery.
Without dataset-level write permissions assigned to the sink's writer identity, log export attempts will fail due to access denied errors.

Key Concept

Cloud Logging Sinks and Service Account Writer Identity Authorization
Estimated Time:1m 30s
Question 1531Question →

An operations team creates a Cloud Logging Log Router sink in a source Google Cloud project to export audit logs to a Pub/Sub topic located in a separate compliance project. After configuring the sink, they observe that log messages are not arriving in the destination Pub/Sub topic. What configuration step is required to enable log delivery?

Show answer & explanation

Answer: Grant the Pub/Sub Publisher role to the unique writer identity service account generated by the Log Router sink on the destination Pub/Sub topic.

Answer

Grant the Pub/Sub Publisher role to the unique writer identity service account generated by the Log Router sink on the destination Pub/Sub topic.
When creating a Cloud Logging Log Router sink to export logs across projects (such as to a Pub/Sub topic, Cloud Storage bucket, or BigQuery dataset), Google Cloud assigns a unique service account known as the sink's writer identity. To allow successful log delivery, this writer identity service account must be granted appropriate predefined IAM permissions—specifically the Pub/Sub Publisher role—directly on the destination Pub/Sub topic.

Step-by-Step Solution

1
Identify the authentication mechanism used by Cloud Logging Log Router sinks.
Recognize that creating a sink automatically provisions a unique service account called a writer identity.
Log Router relies on identity-based IAM authorization to write entries into export destinations.
2
Determine the required IAM role for writing to a Pub/Sub topic across project boundaries.
Identify that the Pub/Sub Publisher role (roles/pubsub.publisher) is required on the destination Pub/Sub topic.
Without this predefined role granted to the sink's specific writer identity, Google Cloud denies delivery attempts.
3
Apply least-privilege security principles to complete the integration.
Assign the Pub/Sub Publisher role specifically to the sink's writer identity service account on the destination topic.
This establishes explicit, minimal permission for cross-project log ingestion.

Key Concept

Log Router Sink Writer Identity and Cross-Project IAM Authorization
Question 1532Question →

A cloud engineer needs to configure a running Compute Engine VM instance to securely read objects from a Cloud Storage bucket using a dedicated user-managed service account following Google Cloud security best practices. In what order should the engineer execute the following steps to complete this configuration using `gcloud` CLI tools?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps is: 1) Create the user-managed service account, 2) Grant the required IAM storage role on the bucket, 3) Stop the Compute Engine instance, 4) Attach the service account with the cloud-platform scope, and 5) Start the instance.
The proper sequence begins by provisioning the identity via IAM service-accounts create, binding the least-privilege predefined storage role to the bucket, stopping the VM instance, applying the new service account identity with full API access scopes using gcloud compute instances set-service-account, and finally starting the instance to enable metadata server token retrieval.

Step-by-Step Solution

1
Provision the service account identity
The service account `app-processor-sa` is created in IAM.
An identity must exist in IAM before permissions can be granted or attached to compute workloads.
2
Bind least privilege IAM roles to the service account
The service account gains read access specifically to objects within the target bucket.
Granting resource-level predefined roles ensures access control compliance prior to workload launch.
3
Stop the target Compute Engine instance
The VM instance transitions to the `TERMINATED` state.
Compute Engine service account association updates require the VM instance to be stopped.
4
Update VM configuration to assign the service account
The VM instance is configured with `app-processor-sa` and the `cloud-platform` access scope.
This configures the instance metadata server identity binding without embedding static keys.
5
Start the VM instance
The VM is running with the new service account identity.
Workloads running on the VM can now automatically query the metadata server for short-lived OAuth access tokens.

Key Concept

Creating and Attaching User-Managed Service Accounts to Compute Instances
Question 1533Question →

A system administrator is configuring a automated backup utility running on an internal corporate server. The utility must periodically upload database backups to a specific Cloud Storage bucket named `prod-backups-bucket` residing in project `prod-data-repository`. Following Google Cloud security best practices for credential management and access control, which strategy should the administrator implement?

Show answer & explanation

Answer: Create a user-managed service account, assign it the predefined `roles/storage.objectCreator` role on the specific bucket, and use service account impersonation or Workload Identity Federation rather than exporting a permanent JSON key file.

Answer

Create a user-managed service account, assign it the predefined `roles/storage.objectCreator` role on the specific bucket, and use short-lived authentication mechanisms such as Workload Identity Federation or service account impersonation instead of exporting static service account keys.
Google Cloud security best practices dictate using predefined roles over primitive roles, scoping permissions to the narrowest resource possible (the target bucket), and avoiding long-lived static JSON service account keys in favor of short-lived credentials or credential federation.

Step-by-Step Solution

1
Determine appropriate IAM scope and role
Selected predefined `roles/storage.objectCreator` granted specifically on the target Cloud Storage bucket `prod-backups-bucket` rather than at project level.
Adheres strictly to Google Cloud's principle of least privilege.
2
Determine authentication mechanism
Avoid exporting static JSON key files and utilize short-lived credentials via Workload Identity Federation or impersonation.
Mitigates security risks associated with long-lived key credential management and leakages.

Key Concept

Service Account Best Practices & Least Privilege IAM
Question 1534Question →

A security compliance team needs to aggregate and retain all admin activity audit logs from every Google Cloud project residing within a specific organizational Folder. The logs must be streamed into a central BigQuery dataset located in a dedicated security project for long-term analysis. You need to configure this aggregated log export while adhering to the principle of least privilege. Which TWO actions should you perform? (Select 2 answers.)

Select all that apply

Show answer & explanation

Answer: Create an aggregated Log Router sink at the Folder level with the destination configured to point to the central BigQuery dataset.; Grant the BigQuery Data Editor role to the sink's writer identity service account on the destination BigQuery dataset.

Answer

The correct actions are to create an aggregated Log Router sink at the Folder level pointing to the destination BigQuery dataset, and to grant the BigQuery Data Editor role to the sink's writer identity service account specifically on the target dataset.
Aggregated Cloud Logging sinks created at a folder level automatically collect log entries from all child projects within that folder. Furthermore, granting the predefined role of BigQuery Data Editor to the sink's writer identity on the target BigQuery dataset enforces least privilege while providing the necessary write permissions for ingestion.

Step-by-Step Solution

1
Identify the resource hierarchy level for log aggregation
To aggregate audit logs from multiple projects under a folder, an aggregated sink must be created at the Folder resource level.
Project-level sinks only collect logs within their own project boundaries, whereas folder-level sinks can include logs across child projects.
2
Configure destination permission using least privilege
Assign the BigQuery Data Editor role to the sink's writer identity on the destination dataset.
Log Router sinks use a service account (writer identity) to publish logs into cross-project destinations, which requires granular permissions on the target resource.

Key Concept

Aggregated Log Router Sinks and Cross-Project IAM Permissions
Question 1535Question →

A junior security administrator needs permission to view standard Admin Activity audit logs within a specific Google Cloud project to investigate resource deletion events. To comply with security requirements, the administrator must not be able to view sensitive Data Access audit logs or modify Cloud Logging configurations. Following Google Cloud best practices for least privilege, which IAM role should be assigned to the administrator?

Show answer & explanation

Answer: Logs Viewer (roles/logging.viewer)

Answer

Assign the Logs Viewer (roles/logging.viewer) predefined role to the administrator.
The correct answer recommendation is the Logs Viewer (roles/logging.viewer) role. It allows users to view standard Admin Activity, System Event, and Access Transparency logs in Cloud Logging. It explicitly does not grant access to view sensitive Data Access logs (which require roles/logging.privateLogViewer) nor does it grant permission to alter log sinks or settings.

Step-by-Step Solution

1
Identify the specific log types required
The requirement requests viewing Admin Activity audit logs only.
Admin Activity logs record administrative writes and configuration changes.
2
Identify security restrictions
Access to Data Access logs must be restricted, and configuration modification permissions must be excluded.
Data Access audit logs contain API calls that read user-provided data and require the specialized Private Logs Viewer role.
3
Select the appropriate IAM role matching least privilege
Logs Viewer (roles/logging.viewer) permits reading standard audit logs while excluding private Data Access logs and logging administrative permissions.
Predefined logging roles separate standard log viewing from private log viewing and logging administrative actions.

Key Concept

IAM permission granularity for Cloud Audit Logs
Question 1536Question →

A DevOps team manages a fleet of Compute Engine Linux virtual machines hosting a critical business application. The team needs to capture guest operating system memory utilization metrics and ingest custom application log files stored at `/var/log/app-service.log` into Google Cloud Observability. Which solution follows Google recommended practices to collect both the memory telemetry and log files?

Show answer & explanation

Answer: Install and configure the unified Google Cloud Ops Agent on each virtual machine instance.

Answer

Installing and configuring the unified Google Cloud Ops Agent on each Compute Engine virtual machine instance is the Google recommended solution.
The Google Cloud Ops Agent is the primary unified agent for Compute Engine virtual machines. It collects system metrics such as CPU, disk, swap, and memory utilization, alongside system and custom log files. Using the Ops Agent is the Google recommended practice for VM guest telemetry.

Step-by-Step Solution

1
Identify the telemetry requirements for the Compute Engine virtual machines.
The requirements demand collecting guest OS memory metrics (not visible to the hypervisor) and custom file-based log entries.
Hypervisors only observe allocated virtual machine capacity, not detailed internal guest memory usage or local files.
2
Evaluate the Google Cloud agent ecosystem for observability.
The Ops Agent combines metric collection (OpenTelemetry-based) and log ingestion (Fluent Bit-based) into a single agent, replacing legacy agents.
Google Cloud recommends the Ops Agent for all standard Compute Engine telemetry collection tasks.
3
Deploy and configure the Ops Agent on the VM fleet.
Configure `/etc/google-cloud-ops-agent/config.yaml` to parse `/var/log/app-service.log` and collect memory telemetry.
The Ops Agent native configuration file allows defining custom file receivers and pipelines alongside standard system metrics.

Key Concept

Google Cloud Ops Agent Deployment
Estimated Time:1m 30s
Question 1537Question →

A cloud compliance engineer needs to extract audit records for all deleted Compute Engine virtual machine instances within a project named `prod-infrastructure`. The engineer wants to run a `gcloud logging read` command that targets only standard Admin Activity audit logs containing the API calls for instance deletion. Which filter expression should be passed to the command?

Show answer & explanation

Answer: logName="projects/prod-infrastructure/logs/cloudaudit.googleapis.com%2Factivity" AND protoPayload.methodName="v1.compute.instances.delete"

Answer

The filter expression `logName="projects/prod-infrastructure/logs/cloudaudit.googleapis.com%2Factivity" AND protoPayload.methodName="v1.compute.instances.delete"` correctly targets Admin Activity audit logs for VM instance deletions.
Admin Activity logs track administrative actions that modify GCP resources and are cataloged under `cloudaudit.googleapis.com/activity`. Cloud Logging structures audit entries within the `protoPayload` object, so filtering by `protoPayload.methodName="v1.compute.instances.delete"` accurately isolates Compute Engine deletion events.

Step-by-Step Solution

1
Identify the correct audit log type stream.
Resource administrative modifications (like deleting a VM instance) are captured under Admin Activity logs (`cloudaudit.googleapis.com/activity`), not Data Access logs.
Admin Activity logs are automatically generated for API calls that modify configuration or metadata of resources.
2
Determine the payload structure for Google Cloud Audit Logs.
Audit log details use the `protoPayload` schema, which contains standard fields such as `methodName`, `authenticationInfo`, and `serviceName`.
Cloud Audit Logs use Protocol Buffer-based AuditLog objects mapped to `protoPayload` in Cloud Logging.
3
Formulate the exact gcloud logging query filter.
Combine `logName="projects/prod-infrastructure/logs/cloudaudit.googleapis.com%2Factivity"` with `protoPayload.methodName="v1.compute.instances.delete"`.
This precisely restricts log retrieval to Compute Engine deletion events within the designated project.

Key Concept

Cloud Audit Logs Filtering and Payload Structure
Estimated Time:1m 15s
Question 1538Question →

A cloud operations team is configuring identity and access management for a microservice deployed on Google Cloud infrastructure. They need to create a dedicated user-managed service account and configure it according to Google Cloud security best practices. Which of the following steps should the team perform to fulfill this requirement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a new user-managed service account in the project using the gcloud iam service-accounts create command.; Grant the service account specific predefined IAM roles that contain only the permissions required for its workload.

Answer

The correct steps are creating a custom user-managed service account using the gcloud CLI tool and granting it specific predefined IAM roles that align with the principle of least privilege.
Creating a dedicated user-managed service account using the gcloud command line interface isolates workload identity. Assigning specific predefined IAM roles ensures that the service account operates strictly under the principle of least privilege.

Step-by-Step Solution

1
Provision identity
Execute 'gcloud iam service-accounts create' to create a dedicated user-managed service account.
Dedicated service accounts isolate application identities so permissions can be managed independently.
2
Assign least privilege roles
Grant predefined IAM roles tailored to the workload's specific resource needs.
Using predefined roles avoids excessive privileges associated with primitive roles (Owner, Editor, Viewer).

Key Concept

Creating User-Managed Service Accounts and Applying Least Privilege
Question 1539Question →

A cloud engineer needs to export application error logs from a Google Cloud project to an analytics team's BigQuery dataset located in a different project. The engineer configures a Cloud Logging Log Router sink with a BigQuery destination. What step must be completed to allow the sink to successfully write log entries to the destination dataset using least-privilege security practices?

Show answer & explanation

Answer: Grant the BigQuery Data Editor role to the unique writer identity service account generated by the Log Router sink on the target BigQuery dataset.

Answer

Grant the BigQuery Data Editor role to the unique writer identity service account generated by the Log Router sink on the target BigQuery dataset.
When configuring a Cloud Logging Log Router sink to export logs to a resource in another project (such as a BigQuery dataset), Cloud Logging generates a unique service account known as the sink's writer identity. To allow log ingestion, the administrator must grant this specific writer identity the appropriate predefined role (BigQuery Data Editor) directly on the destination dataset.

Step-by-Step Solution

1
Identify the service account created by Cloud Logging for the Log Router sink.
The Log Router sink provides a unique service account identifier called a writer identity.
Log Router sinks use service-managed writer identities to authorize cross-project log exports.
2
Assign the minimal required IAM role on the target destination.
The service account gains BigQuery Data Editor access specifically on the target dataset.
This grants the sink permission to write table entries without granting excessive project-level administrative permissions.

Key Concept

Log Router Sink Writer Identity and Cross-Project IAM Configuration
Question 1540Question →

A Security Operations analyst needs to enable tracking for sensitive bucket access and analyze the resulting Cloud Audit Logs for Google Cloud Storage within a specific GCP project. What is the correct sequence of steps to configure audit logging, assign necessary permissions, and retrieve the audit entries?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with configuring IAM & Admin Audit Logs to enable Data Access logging for Cloud Storage, followed by assigning the Private Logs Viewer role to the analyst. Next, open the Logs Explorer interface in the GCP Console, and finally execute the specific query filtering for Cloud Storage Data Access audit logs.
To inspect Data Access audit logs, the logs must first be generated by enabling them under IAM & Admin > Audit Logs. Second, security analysts must hold the Private Logs Viewer role because standard log viewing roles exclude sensitive Data Access payloads. Third, analysts navigate to Logs Explorer, and finally, they submit a filter expression pointing to the Cloud Storage service and the cloudaudit.googleapis.com/data_access log stream.

Step-by-Step Solution

1
Enable Cloud Storage Data Access Logs
GCP begins generating DATA_READ and DATA_WRITE audit events for Cloud Storage operations.
Data Access logs for Cloud Storage are not enabled by default.
2
Grant the Private Logs Viewer IAM Role
The analyst receives authorization to inspect Data Access audit log payloads.
Standard logging viewer permissions are insufficient for viewing sensitive Data Access audit payloads.
3
Access Logs Explorer
The Logs Explorer query builder opens for the project context.
Log viewing and analysis require accessing the log management interface.
4
Apply Search Filter
Matching Cloud Audit Log entries are displayed in the log results pane.
Filtering specifically for serviceName and logName isolates relevant Cloud Storage Data Access events.

Key Concept

Configuring, granting permissions for, and querying GCP Cloud Audit Logs (Data Access logs)
PreviousPage 77 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin