GCP Professional Cloud Security Engineer Practice Question

By default, only Admin Activity and System Event audit logs are always enabled. Data Access audit logs-such as storage.objects.get entries that capture object-level reads in Cloud Storage-are disabled to avoid excessive cost and volume. To collect them, you must explicitly enable the 'Read' Data Access audit log type for Cloud Storage at the appropriate resource level (project or organization). After the additional log type is enabled, you can create a log sink whose filter selects the Cloud Storage Data Access logs and exports them to a BigQuery dataset. Granting Security Admin (or Logging Configuration Writer) on the project lets you create and manage the sink, while giving the security analysts BigQuery Data Viewer access to the destination dataset follows least-privilege principles. Simply adjusting IAM roles or enabling Cloud Monitoring alone will not generate the missing Data Access audit logs, and exporting Admin Activity logs will not include object read events.