Examkin

Soru

Zorluk: ZorViewing and Analyzing Cloud Audit Logs

A cloud security engineer needs to configure Cloud Audit Logging to capture object-level read events in Google Cloud Storage for project `prod-data-vault`, stream these logs into a central BigQuery dataset for compliance auditing, and grant access to the security analysis team. Arrange the implementation steps in the correct logical and technical sequence from start to finish.

  1. 1In the GCP Console under IAM & Admin > Audit Logs, select Google Cloud Storage and explicitly enable the DATA_READ log type.
  2. 2In Cloud Logging, create a Log Router sink targeting the central BigQuery dataset with an inclusion filter specifying protoPayload.serviceName="storage.googleapis.com" AND logName:"cloudaudit.googleapis.com%2Fdata_access".
  3. 3Assign the BigQuery Data Editor role (roles/bigquery.dataEditor) to the service account writer identity automatically generated by the new Log Router sink on the destination BigQuery dataset.
  4. 4Grant the security analysts team the Private Logs Viewer role (roles/logging.privateLogViewer) on the project.

Cevap

The correct order of steps is: 1. Enable DATA_READ Data Access audit logs for Google Cloud Storage in IAM & Admin. 2. Create a Cloud Logging sink filtering for storage Data Access audit logs targeted at BigQuery. 3. Grant the sink's generated writer service account the BigQuery Data Editor role on the destination dataset. 4. Grant security analysts the Private Logs Viewer IAM role.
First, DATA_READ logs for Google Cloud Storage must be enabled under IAM & Admin > Audit Logs because Data Access logging is disabled by default for Cloud Storage. Second, a Log Router sink must be created with the appropriate filter targeting the BigQuery dataset. Third, the unique writer service account created alongside the sink must be assigned BigQuery Data Editor permissions on the target dataset to allow writing logs. Fourth, security analysts must be granted the Private Logs Viewer role because standard Logs Viewer cannot access Data Access audit logs.

Adım Adım Çözüm

1
Enable Cloud Storage Data Access Audit Logs
Google Cloud Storage starts writing DATA_READ access events to audit logs.
Data Access logs for most services are turned off by default. Enabling them in Audit Logs configuration is required before any downstream routing or analysis can occur.
2
Configure the Log Router Sink
A sink rule is established to catch storage Data Access audit logs and route them to BigQuery.
Creating the sink defines the export destination and log filter parameters.
3
Authorize the Sink Service Account
The sink service account is authorized to write log tables into BigQuery.
Log Router sinks use service accounts for authorization. The writer identity must have write access (`roles/bigquery.dataEditor`) to the target dataset.
4
Grant Analyst Read Access to Private Logs
Security analysts gain access to inspect Data Access log entries.
Because Data Access audit logs contain PII and sensitive data access details, Cloud IAM requires the specific `roles/logging.privateLogViewer` role rather than generic logging roles.

Anahtar Kavram

Configuring Cloud Audit Logging export workflows requires four core phases: log activation (Data Access logs are off by default), log sink creation, writer identity IAM authorization, and granular access control (Private Logs Viewer for Data Access logs).
Bu soruyu puanla

Konular

Viewing and Analyzing Cloud Audit Logs

Bu konudan daha fazla soru