GCP Professional Cloud Architect Practice Question

Your organization needs to build a centralized log sink that collects only the entries created when Google Cloud performs automatic actions such as Compute Engine live-migration, hypervisor maintenance, or automatic node restarts. The security team also wants to guarantee that these entries are always written, even if individual project administrators change their own logging configurations, and that the logs do not incur additional ingestion charges. Which Cloud Audit Logs type should you specify in the sink's inclusion filter, and why?

Policy Denied audit logs - they record system-generated denial events and cannot be disabled, so they will include the needed maintenance actions.
Admin Activity audit logs - they capture all configuration changes by users and are always enabled, ensuring the required events are logged.
Data Access audit logs - they track metadata and data reads or writes and are generated without charge when enabled across projects.
System Event audit logs - they are written for platform-initiated actions, are always enabled, and are ingested at no additional cost.

Report Issue

Answer Description

System Event audit logs are generated by Google Cloud itself whenever the platform performs internal operations that modify customer resources-for example, when the infrastructure live-migrates a VM or restarts it after a host failure. These logs are always on and cannot be disabled at the project, folder, or organization level, so they will be captured regardless of any logging changes made by project owners. Like all always-on audit logs, their ingestion into Cloud Logging does not incur additional charges. Admin Activity logs are also always on and free, but they record actions initiated by users or service accounts rather than automatic platform operations, so they would miss the required events. Data Access logs are disabled by default and can generate extra costs, while Policy Denied logs only record authorization failures, not successful maintenance actions.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.