Examkin

Soru

Zorluk: ZorViewing and Analyzing Cloud Audit Logs

A security compliance auditor needs to inspect Data Access audit logs in a Google Cloud project to investigate access patterns for sensitive Cloud KMS keys. The auditor currently holds the Logs Viewer (roles/logging.viewer) role at the project level, but queries in Logs Explorer return no results for Data Access logs. Following the principle of least privilege, which action should you take to enable the auditor to view these logs?

  1. Grant the auditor the Private Logs Viewer (roles/logging.privateLogViewer) role at the project level.Cevap
  2. B
    Grant the auditor the primitive Viewer (roles/viewer) role at the project level.
  3. C
    Grant the auditor the Private Logs Viewer (roles/logging.privateLogViewer) role at the resource log bucket level while revoking roles/logging.viewer at the project level to override parent access.
  4. D
    Grant the auditor the Owner (roles/owner) role at the parent Organization level.

Cevap

Grant the auditor the Private Logs Viewer (roles/logging.privateLogViewer) role at the project level.
In Google Cloud Observability, Data Access audit logs are restricted because they may contain sensitive user data or API metadata. While the Logs Viewer role allows reading standard system logs and Admin Activity audit logs, reading Data Access audit logs requires the Private Logs Viewer (roles/logging.privateLogViewer) role, which includes the logging.privateLogEntries.list permission.

Adım Adım Çözüm

1
Identify the specific audit log category requested.
The scenario requires analyzing Data Access audit logs, which contain sensitive access metadata.
Data Access audit logs are restricted separately from standard logs and Admin Activity logs.
2
Evaluate the current IAM permissions.
The existing Logs Viewer (roles/logging.viewer) role lacks the logging.privateLogEntries.list permission.
Without explicit private log permissions, Data Access log entries are filtered out from query results.
3
Select the appropriate role adhering to least privilege.
Assigning Private Logs Viewer (roles/logging.privateLogViewer) supplies the necessary permission without granting unnecessary administrative permissions.
This role targets private log entry viewing specifically.

Anahtar Kavram

Data Access Audit Logs IAM Permissions
Bu soruyu puanla

Konular

Viewing and Analyzing Cloud Audit Logs

Bu konudan daha fazla soru