GCP Professional Cloud Security Engineer Practice Question

Admin Activity audit logs are written automatically for all Google Cloud services and record configuration-changing API calls such as the creation, update, or deletion of Cloud SQL instances. These logs are always on and their ingestion does not generate charges. By creating an organization-level log sink that filters for the Cloud SQL Admin Activity log entries, the events can be forwarded to the central log bucket without turning on any additional, billable log types. Enabling Data Access logs, Asset Inventory feeds, or maintenance events would either incur extra logging fees or fail to capture every configuration-changing API call.