Granting External Auditors Access to BigQuery Audit Logs
You need to configure IAM access audit logging in BigQuery for external auditors. You want to follow Google-recommended practices. What should you do?
Answer
Correct answer: A — Add the auditors group to the logging.viewer and bigQuery.dataViewer predefined IAM roles to give external auditors audit-log access the Google-recommended way.
Community Insight
The tested concept is Google's recommended pattern for auditor access — assign predefined roles to a group — and the trap is picking individual user accounts or over-engineering custom roles, which violate least-privilege management and maintainability guidance.
For external auditors needing access to IAM access audit logs stored in BigQuery, Google recommends granting predefined roles (logging.viewer and bigQuery.dataViewer) to a dedicated auditors group rather than to individual accounts or custom roles. This question tests whether you know Google's identity-management best practice of using groups plus predefined roles for auditable, easy-to-manage access.
Option C is the most tempting wrong answer: granting roles directly to individual auditor user accounts works technically, but Google's auditing job-function guidance specifically says to manage auditor access through a group so membership can be added or removed centrally at each audit engagement.
Community Discussion (121 comments)
ermlol13
👍 1
Selected: A
Best practice with a group for the auditors and for two IAM rules which predefined IAM rules is best fit.
Urticas
👍 1
Selected: A
A follows Google’s recommended approach: groups + predefined roles + least privilege
svij87
👍 1
Selected: A
A is the answer
tabnaz
👍 1
Selected: A
Correct is A.
Cloudmoh
👍 1
Selected: A
Based on best practices, A group should be created, and both auditors should be added and predefined 'logging.viewer' and 'bigQuery.dataViewer roles will be granted.
Enamfrancis
👍 1
Selected: A
I will go A
Seleth
👍 1
Selected: A
The organization creates a Google group for these external auditors and adds the current auditor to the group. This group is monitored and is typically granted access to the dashboard application. https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
garg.vnay
👍 1
Correct Answer is A. you should add a role to the group of users instead of adding particular users in IAM
andreiboaghe95
👍 1
Selected: A
correct answer is A
sinh
👍 1
Selected: A
auditors group
sinh
👍 2
https://cloud.google.com/iam/docs/job-functions/auditing?hl=ja#scenario_external_auditors
thewalker
👍 2
Selected: A
A Create a group with the auditors, grant 'logging.viewer' and 'bigQuery.dataViewer roles to the group on a table / view with the required data.
gsmasad
👍 2
Selected: A
AS per Google best practices the roles should be assigned to a group & not to individual users
ArtistS
👍 4
A is correct. 1st you should know this is a exam. Google recommend xxx means you should choose group first.
YourCloudGuru
👍 5
Selected: A
The correct answer is A. This option follows Google-recommended practices, because it allows you to grant auditors access to view audit logs without granting them access to other resources in your project. The other options are not as good: Option B is not as good, because it requires you to create two new custom IAM roles. This can be complex and time-consuming. Option C is not as good, because it grants auditors access to all audit logs in your project, including audit logs for resources that they do not need access to. * Option D is not as good, because it grants auditors access to all data in your BigQuery datasets, including data that they do not need access to.
Captain1212
👍 3
Selected: A
Google Recommended Practice A is the correct Answer add the users in the group then grant them the access
sthapit
👍 1
C Option A, which suggests adding the auditors group to predefined roles, might not be as appropriate as using individual auditor user accounts. It's generally a best practice to assign permissions to specific users rather than groups, as it provides better granularity and control over access.
ExamsFR
👍 2
Selected: A
Correct answer is A
vinodthakur49
👍 1
Selected: C
There is no group created already, so C is the right answer.
smanoj85
👍 5
Correct Answer is B By creating a custom IAM role, you can specify the exact permissions that the auditors need, and avoid granting them unnecessary permissions that come with predefined IAM roles. In this case, you can create two custom IAM roles: one for 'logging.viewer' and one for 'bigQuery.dataViewer', and grant the corresponding permissions to each role. Then, you can add the auditors group to these custom roles to give them access to the required logs and data.
smanoj85
👍 1
Correct Answer is B Option A is incorrect because the logging.viewer and bigQuery.dataViewer roles only grant read access to logs and data in BigQuery, respectively. These roles do not provide audit logging capabilities. Option C is incorrect because it suggests adding individual user accounts to the roles, whereas the question specifically asks for adding an auditors group. In addition, adding individual user accounts can be difficult to manage and does not scale well as the number of auditors increases. It is generally recommended to use groups for managing access whenever possible. Option D suggests adding the auditor user accounts to two new custom IAM roles, which could work. However, the question specifically asks for following Google-recommended practices. The recommended practice is to use predefined roles over custom roles whenever possible. Therefore, option B, which suggests adding the auditors group to two new custom IAM roles, is not recommended.
red_panda
👍 3
Selected: B
B is correct. Is a best practice to prefer custom role, specially for external users.
asallo
👍 1
A is the most appropriate Answer
Buruguduystunstugudunstuy
👍 3
Selected: B
I would say that Answer A is not the correct answer. While it is true that adding the auditor's group to the 'logging.viewer' and 'bigQuery.dataViewer' roles would allow them to view the logs and data in BigQuery, it does not enable IAM access audit logging. The correct answer is Answer B - Add the auditors group to two new custom IAM roles. You should create custom IAM roles with the necessary permissions to view IAM audit logs in BigQuery and assign those roles to the auditor's group. This follows the Google-recommended practice of using custom roles to grant least privilege access to resources. Answer C is incorrect because you should not add users' accounts to predefined IAM roles like logging.viewer or bigQuery.dataViewer. Predefined roles are meant to provide a general set of permissions for common use cases, and adding users or groups to them may grant them unnecessary access. Answer D is not the best practice as it is better to create separate custom IAM roles for each type of user rather than combining them.
Bobbybash
👍 4
Selected: B
B.... The recommended practice for configuring IAM access audit logging in BigQuery is to create two custom IAM roles for auditors: one with the bigquery.datasets.get permission, and the other with the bigquery.tables.getData permission. You should then add the auditors group to these custom IAM roles. This will allow auditors to view metadata about datasets and access data within tables, while preventing them from performing other operations on the BigQuery resources. Therefore, option B is the correct answer.
skindar
👍 2
Answer A https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
processor
👍 1
Selected: A
Once again, the "correct" answer is wrong. (Regarding google best practices). How could you hope someone gives money to get wrong answers. A is the good one.
jrisl1991
👍 1
Honestly, I think some answers are "wrong" on purpose because if they all were right, the website could be taken as a "cheat" instead of help to study. Correct answer is A.
glanshima
👍 2
Correct A The organization creates a Google group for these external auditors and adds the current auditor to the group. This group is monitored and is typically granted access to the dashboard application. see: https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
vijay456
👍 2
Selected: A
https://cloud.google.com/iam/docs/job-functions/auditing
vijay456
👍 3
Selected: C
there is no group created and no option syas create group too, so provided option C is suitable best answer
leogor
👍 1
A, auditors group
PSS387
👍 1
Selected: A
Google recommends to group users to allow permissions
PKookNN
👍 2
Selected: A
best practices recommend going with group instead of individual users so A is more correct than C
Cornholio_LMC
👍 1
had this question today
DjayTest21
👍 1
Selected: A
A is correct
iadarsh
👍 1
Selected: A
A is Correct Because if you directly add users to the IAM roles, then if any users left the organization then you have to remove the users from multiple places and need to revoke his/her access from multiple places. But, if you put a user into a group then its very easy to manage these type of situations. Now, if any user left then you just need to remove the user from the group and all the access got revoked
12234
👍 1
Selected: A
A is correct
RanjithK
👍 1
Answer is A
AzureDP900
👍 2
A is right.. don't fall on trap with C
haroldbenites
👍 1
Go for A https://cloud.google.com/iam/docs/job-functions/auditing https://cloud.google.com/iam/docs/job-functions/auditing
haroldbenites
👍 1
Scenario: External auditors The organization creates a Google group for these external auditors and adds the current auditor to the group. This group is monitored and is typically granted access to the dashboard application. During normal access, the auditors' Google group is only granted access to view the historic logs stored in BigQuery. If any anomalies are discovered, the group is granted permission to view the actual Cloud Logging Admin Activity logs via the dashboard's elevated access mode. At the end of each audit period, the group's access is then revoked. Data is redacted using Cloud DLP before being made accessible for viewing via the dashboard application. The table below explains IAM logging roles that an Organization Administrator can grant to the service account used by the dashboard, as well as the resource level at which the role is granted.
YaaElon
👍 2
Selected: A
Best practice is to add to groups
jgnogueira
👍 1
Selected: A
The main best practice in any attribution of permission is to create a group
theBestStudent
👍 1
Answer is A. Google recommended practices is to use PREDEFINED roles (As in this case we need granularity to give specific roles to the group). And also use groups
Echo89
👍 1
A for sure
kchandank
👍 1
Selected: A
A is right
BAPII
👍 1
Selected: A
Google recommends to create a group.
Raz0r
👍 1
Selected: A
A is right no cap
sasonian
👍 2
Selected: A
A is the answer
Sekierer
👍 2
Selected: A
A is correct
rafsrod
👍 3
Selected: A
A. Add the auditors group to the ג€˜logging.viewerג€™ and ג€˜bigQuery.dataViewerג€™ predefined IAM roles. Check: https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
onyb
👍 1
Correct Answer is A, for the simple reason that controlling access via Groups is easier than managing them individually
AndresBayona
👍 2
Selected: A
https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
AndresBayona
👍 1
I gess the correct answer is A beacuse of this link https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
Nikimiki
👍 4
The true evil is this question itself is so dumb, so American, so confusing.... two options A and C are both arguably correct on their own term. The big question is why this kind of vague, ambiguous questions show up in the exam to create confusion. It is not testing technical skill or knowledge, but it is starting a whole new philosophical debate! Another oddity is who has the golden key for all these questions? Who is showing you those "Correct Answer" when you click on the "Reveal Answer"? This nation is increasingly dumber and dumber!
GreenTick
👍 1
they expect the best answer (efficient, low cost, best practice).
TenshiD
👍 2
Selected: A
A is correct
alaahakim
👍 1
Correct is A
shawnkkk
👍 1
A. Add the auditors group to the ג€˜logging.viewerג€™ and ג€˜bigQuery.dataViewerג€™ predefined IAM roles.
vishnukumartr
👍 1
A. Add the auditors group to the ג€˜logging.viewerג€™ and ג€˜bigQuery.dataViewerג€™ predefined IAM roles.
Jaira1256
👍 1
A is correct
ankatsu2010
👍 1
Add user/group to role or add role to user/group?
Shruti_Pal
👍 1
A is correct
Chotebhaisahab
👍 1
Yes I agree A is the correct one
Student7
👍 1
A. Add the auditors group to the "˜logging.viewer' and "˜bigQuery.dataViewer' predefined IAM roles.
Agraved
👍 2
Answer has to be A, as per Google Best Practice and practically make sense. Would be useless to add individuals to roles one by one
mcaromit
👍 1
A seems correct, though the question is not entirely clear to me
manish_109
👍 10
is every 2 of 5 qstn in this forum is wrong .i have to check for every qstn that it is correct or not :(
here2help
👍 9
It's crazy to me how who ever answered these, answers them incorrectly and then puts a link up that directly contradicts themselves. The correct answer is A. Google always recommends adding users to a group and then giving the group access. Additionally, Google recommends to use predefined roles since they have been well thought out when created, and are there to save companies the hassle of having to know what granular access every single person needs.
max94
👍 1
Correct is A. And here is explanation why its A and not B: Predefined roles are created and maintained by Google. Google automatically updates their permissions as necessary, such as when Google Cloud adds new features or services. Custom roles are user-defined, and allow you to bundle one or more supported permissions to meet your specific needs. Custom roles are not maintained by Google; when new permissions, features, or services are added to Google Cloud, your custom roles will not be updated automatically. https://cloud.google.com/iam/docs/understanding-custom-roles
r1ck
👍 2
A : always use groups as possible
kopper2019
👍 1
A, https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
pca2b
👍 1
A: Use groups when possible, and Use predefined roles when possible
sumanshu
👍 2
Vote for C
tavva_prudhvi
👍 1
Refer to this article, it clearly mentioned option A, and the best-recommended practices are to give permissions to groups. https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
tarang3
👍 1
Answer is C
tarang3
👍 2
@tavva_prudhvi i agree upon checking the link provided by you that the answer is "A"
EABDAJA
👍 1
A is correct
Jacky_YO
👍 1
My Answer : C https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors Scenario: External auditors Role: Logging.viewer , Resource : Organization , Member : Dashboard Service Account , Description :The logging.viewer role permits the service account to read the Admin Activity logs in Cloud Logging. ex: { "bindings": [{ "role": "roles/logging.viewer", "members": [ "serviceAccount: [email protected] " ] }] }
pas77
👍 2
You really didn't read the link you've provided. It clearly shows to add users to a group. Coinciding with option A.
ShakthiGCP
👍 1
Ans: A .
Rimjith
👍 1
"Audit group" is not available by default and option A is not saying to create to one. So I believe possible answer is Option C
ShakthiGCP
👍 1
There is nothing called Audit groups... study about "google groups". Dont get confused.
JackGlemins
👍 1
A is right: https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors The organization creates a Google group for these external auditors and adds the current auditor to the group. This group is monitored and is typically granted access to the dashboard application.
Vinod87
👍 1
Correct is A.
GCP_Student1
👍 1
https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
Nickkk
👍 1
Answer : A Srouce : https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
INASR
👍 2
Correct is A. Scenario: External auditors (From Google Documents) In this scenario, audit logs for an organization are aggregated and exported to a central sink location. A third-party auditor is granted access several times a year to review the organization's audit logs. The auditor is not authorized to view PII data in the Admin Activity logs. To comply with this requirement, a dashboard is available that provides access to the historic logs stored in BigQuery, and on request, to the Cloud Logging Admin Activity logs. The organization creates a Google group for these external auditors and adds the current auditor to the group. This group is monitored and is typically granted access to the dashboard application.
GCP_Student1
👍 3
C is the correct option; https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
jay1992
👍 1
You nailed it
GCP_Student1
👍 2
I will take it back answer is A A. Add the auditors group to the "˜logging.viewer' and "˜bigQuery.dataViewer' predefined IAM roles.
nherrerab
👍 1
A is correct.
krunals
👍 1
Correct Answer is A It is always best practice to create a group, add team members to it and provide access to group. It is always easy to add/remove team members to group.
vara3dk
👍 1
Correct Ans is A The organization creates a Google group for these external auditors and adds the current auditor to the group. logging.viewer and bigQuery.dataViewer
JKRowlings
👍 2
Ans is A. Best practice for easier management of user account is to use group.
Bhagirathi
👍 2
Dont confuse everyone - it should be A.
swatititame
👍 1
• A. Add the auditors group to the "˜logging.viewer' and "˜bigQuery.dataViewer' predefined IAM roles.
hems4all
👍 2
Answer is A: Grant the auditors’ group roles/logging.viewer and roles/bigquery.dataViewer IAM roles. is the right answer. For external auditors, Google recommends we grant logging.viewer and bigquery.dataViewer roles. Since auditing happens several times a year to review the organization's audit logs, it is recommended we create a group with these grants and assign the group to auditor user accounts during the time of the audit. Ref: https://cloud.google.com/iam/docs/roles-audit-logging#scenario_external_auditors
nwk
👍 1
Vote A, easier to manage with group
Ravihonnagiri
👍 2
Answer is A The organization creates a Google group for these external auditors and adds the current auditor to the group. This group is monitored and is typically granted access to the dashboard application.
qafro
👍 1
I think A is the correct one
glam
👍 1
A. Add the auditors group to the "˜logging.viewer' and "˜bigQuery.dataViewer' predefined IAM roles.
bayurzx
👍 1
The correct answer is A. As you can see in this link for a scenario with external auditors https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
glam
👍 1
A.......
prasanu
👍 1
Ans is A, As google recommnds always create a group and add role into the group
AZahid
👍 1
A * The organization creates a Google group for these external auditors https://cloud.google.com/iam/docs/job-functions/auditing
ESP_SAP
👍 1
Correct answer is A: Based on : Delegate responsibility with groups and service accounts We recommend collecting users with the same responsibilities into groups and assigning IAM roles to the groups rather than to individual users. https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations
ESP_SAP
👍 1
https://cloud.google.com/bigquery/docs/access-control#bigquery https://cloud.google.com/iam/docs/job-functions/auditing#scenario_operational_monitoring
ESP_SAP
👍 3
Correct asnwer is A: Based on : Delegate responsibility with groups and service accounts We recommend collecting users with the same responsibilities into groups and assigning IAM roles to the groups rather than to individual users.
JavierCorrea
👍 48
Correct answer is A as per: https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
ArtistS
👍 1
very useful The organization creates a Google group for these external auditors and adds the current auditor to the group. This group is monitored and is typically granted access to the dashboard application
rambest
👍 2
Correct Answer is A as per google recommended practice , assign role to group instead of user.
adeice
👍 2
I can create External group and Internal group Auditors
robor97
👍 14
The question literally says - External Auditors
poogcp
👍 3
A is the correct one , as per google recommended practice , assign role to group instead of user
mlantonis
👍 3
Correct is A as you use group and predefined roles.
ankit89
👍 3
Option A is correct, see document, https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations
leba
👍 6
Correct is C The organization creates a temporary auditor account for each audit period. This account is monitored and is typically granted access to the dashboard application.
coldpar
👍 83
Correct is A. As per google best practices it is recommended to use predefined roles and create groups to control access to multiple users with same responsibility
droogie
👍 5
You assume Auditors Group = External Auditors only. Auditors Group may contain both Internal and External Auditors.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A matches Google's official external-auditor scenario in the IAM auditing job-function documentation: create an auditors group and grant it the predefinedlogging.viewer role (to read audit logs, including those exported to BigQuery) and the bigQuery.dataViewer role (to query the log dataset). Using a group means access is granted and revoked in one place, which is essential when external auditors rotate in and out per audit period. Using predefined roles means Google maintains the permission set, so the roles stay current without administrative overhead.Why the Other Options Are Wrong
Options C and D assign roles to individual user accounts, which contradicts the group-based management Google recommends and makes offboarding each auditor a separate, error-prone task. Options B and D introduce two new custom roles; custom roles require you to define and then maintain every permission yourself, and Google recommends predefined roles for well-defined job functions like auditing because they are already vetted and least-privilege scoped. A custom-role approach also defeats the purpose of the documented auditing job-function template.Community Comment Notes
The community strongly converged on A, with coldpar noting that "As per google best practices it is recommended to use predefined roles and create groups to control access to multiple users with same responsibility" and JavierCorrea citing the official auditing job-function page directly. here2help added that "Google always recommends adding users to a group and then giving the group access," and YourCloudGuru emphasized that this keeps auditors able to view logs without access to other resources. The lone dissenters — one arguing for individual accounts and one for custom roles — were contradicted by the official documentation rather than by opinion, so the group-plus-predefined-roles answer stands.Official Reference
Exam Strategy
On ACE-style questions, the phrase 'Google-recommended practices' is a signal to pick group-based access with predefined roles over individual accounts or custom roles. Custom roles are the right answer only when the question explicitly stresses least privilege beyond what predefined roles offer.
Frequently Asked Questions
Why grant audit log access to a group instead of individual auditor accounts?
A group lets you add or remove all auditors centrally in one place when an audit engagement starts or ends, instead of editing IAM bindings for each user account separately.
Why use predefined roles instead of custom roles for external auditors?
Google's auditing job-function guidance says predefined roles like logging.viewer and bigQuery.dataViewer are already vetted for the auditor use case, so you avoid the maintenance burden of defining and updating custom permissions.
Related Analysis
Practice All ACE Questions
Access 84 questions with complete answers and detailed explanations.
View Full ACE Practice Test →