GCP Professional Cloud Security Engineer Practice Question

Your organization aggregates all Cloud Audit Logs from several production projects into a dedicated logging project. DevOps engineers must be able to view Admin Activity logs for troubleshooting but must not see any Data Access or Access Transparency entries. The security operations team requires full visibility into every audit record. Which configuration best applies the principle of least privilege while meeting both requirements?

Remove Logging IAM roles entirely, enable Cloud Storage object ACLs on the bucket, and give DevOps Storage Object Viewer while giving security operations Storage Object Admin.
Grant DevOps roles/logging.privateLogViewer and grant security operations roles/logging.admin; rely on default permissions.
Create a log view that filters out Admin Activity logs, then grant both teams roles/logging.viewer and have security operations switch views when needed.
Grant DevOps roles/logging.viewer on the centralized log bucket and grant security operations roles/logging.privateLogViewer; no extra log views are configured.

Report Issue

Answer Description

roles/logging.viewer allows users to read most log entries, but it automatically hides sensitive categories such as Data Access and Access Transparency logs. Giving this role to DevOps engineers lets them view Admin Activity logs yet blocks the private logs they are not authorized to see. roles/logging.privateLogViewer grants read-only access to all logs, including the private ones; assigning it to the security operations team satisfies their need for complete visibility. Because the permission boundary is already enforced by the roles themselves, no additional log views, object ACLs, or bucket-level work-arounds are necessary. Granting DevOps broader roles (for example, logging.privateLogViewer or logging.admin) or replacing Logging IAM roles with Cloud Storage ACLs would violate least-privilege principles or fail to give the correct level of access.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.