GCP Professional Cloud Security Engineer Practice Question

A security engineer notices repeated "error: PERMISSION_DENIED" responses in an application that calls Cloud Storage, but the project's Admin Activity and Data Access audit logs show no matching entries. To trace the root cause, the engineer wants to rely on Policy Denied audit logs. Which statement correctly describes how these logs behave in Google Cloud Logging and helps the engineer decide on next steps?

They are generated only when IAM denial conditions block access; Organization Policy or VPC Service Controls blocks are logged as Data Access events that must be enabled first.
They are always written to Cloud Logging for every Google Cloud service at no additional cost and cannot be disabled, so the engineer can immediately query them to see which security policy blocked the calls.
They are automatically promoted to Cloud Monitoring alert policies, so the engineer should check the Monitoring alert history instead of Cloud Logging.
They require per-service opt-in similar to Data Access audit logs; the engineer must enable Policy Denied logging for Cloud Storage before entries will appear.

Report Issue

Answer Description

Policy Denied audit logs are generated automatically whenever a request to a Google Cloud API is blocked by a security policy such as IAM denial, an Organization Policy constraint, Access Context Manager perimeter, or VPC Service Controls. Unlike Data Access audit logs-which must be explicitly enabled for most services-Policy Denied logs are always on for all Google Cloud services, cannot be disabled, and are written to Cloud Logging free of charge. Therefore, if the application calls are being rejected by a security policy, the engineer will find the relevant entries in the project's audit log bucket without needing to turn on additional logging or incur extra costs. Other statements are incorrect: Policy Denied logs are not limited to only IAM-denied calls, they are not subject to per-API opt-in, and they do not automatically trigger Cloud Monitoring alerts unless such alerts are explicitly configured.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.