GCP Professional Cloud Security Engineer Practice Question

Cloud Audit Data Access logs have the log name that ends with cloudaudit.googleapis.com%2Fdata_access. To further restrict the export to BigQuery activity, the filter must also match the service that generated the audit entry: protoPayload.serviceName="bigquery.googleapis.com". Combining both conditions guarantees that only BigQuery Data Access audit logs are selected, excluding Admin Activity, System Event, Policy Denied, and Data Access logs from other services.

The correct filter therefore uses:

• logName="projects/*/logs/cloudaudit.googleapis.com%2Fdata_access" to capture only Data Access logs from every project under the organization.
• protoPayload.serviceName="bigquery.googleapis.com" to restrict the logs to BigQuery.

The other options are incorrect:

• The expression that relies solely on the log name with bigquery.googleapis.com%2Fdata_access is invalid because BigQuery audit logs are recorded under cloudaudit.googleapis.com, not a service-specific path.
• The filter that matches only protoPayload.methodName allows other log types (for example Admin Activity) and includes non-BigQuery services using similar method prefixes, exporting extra logs.
• The filter that targets resource.type="bigquery_dataset" and cloudaudit.googleapis.com%2Factivity captures Admin Activity logs, not Data Access, and would miss Data Access logs entirely.

Therefore the first filter is the only one that exports exactly the required subset.