GCP Professional Cloud Security Engineer Practice Question

Admin Activity audit logs from the IAM API are written under the log name cloudaudit.googleapis.com/activity. When any user or service creates a user-managed key, the IAM Admin API method recorded in the log entry is google.iam.admin.v1.CreateServiceAccountKey. Scoping the alert filter to:

• the centralized Admin Activity log (logName="organizations/…/logs/cloudaudit.googleapis.com%2Factivity"),
• the IAM service (protoPayload.serviceName="iam.googleapis.com"), and
• the exact method that creates a key (protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey") ensures that the alert triggers only for key-creation events and not for other IAM changes.
  The other filters are incorrect because:
• The second option watches for any log entry with severity ERROR on the service_account resource type; it would miss successful key creations and generate noise from unrelated errors.
• The third option targets Data Access logs and the DownloadServiceAccountKey method, which detects key downloads, not creation, and would require enabling Data Access logs (often disabled by default).
• The fourth option uses a wildcard project-level log name and the SetIamPolicy method, catching many unrelated IAM changes and generating false positives, while missing key creation events.