Examkin

Question

Difficulty: EasySecurity Logging, Audit Logs, and Security Command Center

A security administrator needs to investigate which user modified IAM permissions and created new Compute Engine instances within a project. The administrator requires access to log entries that record administrative actions and configuration changes. Which Cloud Audit Logs category provides this record and is enabled by default across all Google Cloud projects?

  1. Admin Activity audit logsAnswer
  2. B
    Data Access audit logs
  3. C
    Customer-Managed Encryption Key (CMEK) audit logs
  4. D
    Primitive IAM Viewer event logs

Answer

Admin Activity audit logs contain entries for API calls or administrative actions that modify resource configurations or metadata, and they are always enabled by default.
Admin Activity audit logs record API calls or administrative actions that alter the configuration or metadata of Google Cloud resources. These logs are generated automatically and enabled by default across all projects, making them the correct choice for auditing IAM and instance creation operations.

Step-by-Step Solution

1
Identify the type of operation being audited.
The operation involves modifying resource metadata and project configuration (IAM permissions and Compute Engine instance creation).
Administrative actions modifying resources fall under Admin Activity logs.
2
Determine default log enablement in Google Cloud.
Admin Activity audit logs are written automatically for all resources and cannot be disabled.
Google Cloud enforces Admin Activity logging by default for security governance.

Key Concept

Cloud Audit Logs categories and default enablement behavior
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic