GCP Professional Cloud Security Engineer Practice Question

Your company operates regulated workloads on several Google Cloud projects. Compliance policy requires an immutable audit trail of every time Google support engineers access your data or configurations. The security team already exports all Cloud Audit Logs to a centralized BigQuery dataset through an aggregated organization-level log sink. Which action should you take to satisfy the new requirement with minimal changes to the existing logging pipeline?

Enable Access Approval on every project so that any Google personnel access must be explicitly authorized, eliminating the need for additional logging.
Turn on Data Access logs for all services and export them; these logs automatically include provider actions alongside customer actions.
Enable Access Transparency at the organization level and rely on the existing aggregated Log Router sink to export the new access_transparency log entries to BigQuery.
Create a Cloud Monitoring alert that scans Admin Activity logs for principalEmail values ending with @google.com and notifies compliance when detected.

Report Issue

Answer Description

Access Transparency (AT) is the only Google Cloud feature that records and exposes provider-side administrative activity such as support engineer access. When AT is enabled for the organization, the platform automatically delivers additional log entries whose logName ends in "access_transparency" to Cloud Logging. Because the company already uses an aggregated organization-level log sink that routes all Cloud Audit Logs to BigQuery, the same sink can be extended (or left unchanged if it includes all log names) to capture the new AT log entries with no architectural change.

Access Approval blocks provider access until approval is granted, but it does not by itself create audit logs. Data Access logs and Admin Activity logs cover customer and service-account actions, not internal Google personnel events. Searching existing Admin Activity logs for @google.com principals would miss many internal workflows that are only surfaced through AT. Therefore, enabling Access Transparency and relying on the existing centralized sink is the correct approach.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.