An organization is establishing baseline security logging policies across their Google Cloud projects. Which of the following statements accurately describe default behavior and capabilities of Google Cloud Audit Logs? (Select TWO)
- Admin Activity audit logs are enabled by default for all Google Cloud services and do not incur log ingestion costs.Answer
- Data Access audit logs are disabled by default for most services because they record high-volume data read and write operations.Answer
- CAssigning primitive IAM roles such as Editor ensures that service accounts cannot alter security log sinks.
- DRelying strictly on IAM role bindings is sufficient to prevent authorized users from exfiltrating audit log data to external locations.
Answer
Admin Activity audit logs are enabled by default at no cost, and Data Access audit logs are disabled by default for most GCP services to avoid excessive log ingestion.
Admin Activity audit logs are enabled automatically across all GCP resources without additional ingestion charges. Conversely, Data Access audit logs are disabled by default (except BigQuery) to manage data ingestion volume and log storage expenses.
Step-by-Step Solution
Key Concept
Cloud Audit Log Types and Default Configuration