Granting External Auditors Access to BigQuery Audit Logs

ACE By islever Editorial Last updated

Managing Identity and Access Management (IAM).

Short answer

A Add the auditors group to the logging.viewer and bigQuery.dataViewer predefined IAM roles to give external auditors audit-log access the Google-recommended way.

Question

You need to configure IAM access audit logging in BigQuery for external auditors. You want to follow Google-recommended practices. What should you do?
  1. Add the auditors group to the ג€˜logging.viewerג€™ and ג€˜bigQuery.dataViewerג€™ predefined IAM roles. Correct Answer
  2. Add the auditors group to two new custom IAM roles.
  3. Add the auditor user accounts to the ג€˜logging.viewerג€™ and ג€˜bigQuery.dataViewerג€™ predefined IAM roles.
  4. Add the auditor user accounts to two new custom IAM roles.

Key Takeaways

The tested concept is Google's recommended pattern for auditor access — assign predefined roles to a group — and the trap is picking individual user accounts or over-engineering custom roles, which violate least-privilege management and maintainability guidance.

For external auditors needing access to IAM access audit logs stored in BigQuery, Google recommends granting predefined roles (logging.viewer and bigQuery.dataViewer) to a dedicated auditors group rather than to individual accounts or custom roles. This question tests whether you know Google's identity-management best practice of using groups plus predefined roles for auditable, easy-to-manage access.

Common mistake: Option C is the most tempting wrong answer: granting roles directly to individual auditor user accounts works technically, but Google's auditing job-function guidance specifically says to manage auditor access through a group so membership can be added or removed centrally at each audit engagement.

Expert Analysis

Why the Answer Is Correct

Option A matches Google's official external-auditor scenario in the IAM auditing job-function documentation: create an auditors group and grant it the predefined logging.viewer role (to read audit logs, including those exported to BigQuery) and the bigQuery.dataViewer role (to query the log dataset). Using a group means access is granted and revoked in one place, which is essential when external auditors rotate in and out per audit period. Using predefined roles means Google maintains the permission set, so the roles stay current without administrative overhead.

Why the Other Options Are Wrong

Options C and D assign roles to individual user accounts, which contradicts the group-based management Google recommends and makes offboarding each auditor a separate, error-prone task. Options B and D introduce two new custom roles; custom roles require you to define and then maintain every permission yourself, and Google recommends predefined roles for well-defined job functions like auditing because they are already vetted and least-privilege scoped. A custom-role approach also defeats the purpose of the documented auditing job-function template.

Community Comment Notes

The community strongly converged on A, with coldpar noting that "As per google best practices it is recommended to use predefined roles and create groups to control access to multiple users with same responsibility" and JavierCorrea citing the official auditing job-function page directly. here2help added that "Google always recommends adding users to a group and then giving the group access," and YourCloudGuru emphasized that this keeps auditors able to view logs without access to other resources. The lone dissenters — one arguing for individual accounts and one for custom roles — were contradicted by the official documentation rather than by opinion, so the group-plus-predefined-roles answer stands.

Official Reference

https://cloud.google.com/iam/docs/job-functions/auditing

This link opens the official vendor documentation in a new tab.

Exam Strategy

On ACE-style questions, the phrase 'Google-recommended practices' is a signal to pick group-based access with predefined roles over individual accounts or custom roles. Custom roles are the right answer only when the question explicitly stresses least privilege beyond what predefined roles offer.

Frequently Asked Questions

Why grant audit log access to a group instead of individual auditor accounts?

A group lets you add or remove all auditors centrally in one place when an audit engagement starts or ends, instead of editing IAM bindings for each user account separately.

Why use predefined roles instead of custom roles for external auditors?

Google's auditing job-function guidance says predefined roles like logging.viewer and bigQuery.dataViewer are already vetted for the auditor use case, so you avoid the maintenance burden of defining and updating custom permissions.

More ACE FAQ →

Discussion 109 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 109

  1. coldpar 👍 83
    Correct is A. As per google best practices it is recommended to use predefined roles and create groups to control access to multiple users with same responsibility
  2. JavierCorrea 👍 48
    Correct answer is A as per: https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
  3. robor97 👍 14
    The question literally says - External Auditors
  4. manish_109 👍 10
    is every 2 of 5 qstn in this forum is wrong .i have to check for every qstn that it is correct or not :(
  5. here2help 👍 9
    It's crazy to me how who ever answered these, answers them incorrectly and then puts a link up that directly contradicts themselves. The correct answer is A. Google always recommends adding users to a group and then giving the group access. Additionally, Google recommends to use predefined roles since they have been well thought out when created, and are there to save companies the hassle of having to know what granular access every single person needs.
Show 25 more comments
  1. leba 👍 6
    Correct is C The organization creates a temporary auditor account for each audit period. This account is monitored and is typically granted access to the dashboard application.
  2. YourCloudGuru 👍 5 Answered A
    The correct answer is A. This option follows Google-recommended practices, because it allows you to grant auditors access to view audit logs without granting them access to other resources in your project. The other options are not as good: Option B is not as good, because it requires you to create two new custom IAM roles. This can be complex and time-consuming. Option C is not as good, because it grants auditors access to all audit logs in your project, including audit logs for resources that they do not need access to. * Option D is not as good, because it grants auditors access to all data in your BigQuery datasets, including data that they do not need access to.
  3. smanoj85 👍 5
    Correct Answer is B By creating a custom IAM role, you can specify the exact permissions that the auditors need, and avoid granting them unnecessary permissions that come with predefined IAM roles. In this case, you can create two custom IAM roles: one for 'logging.viewer' and one for 'bigQuery.dataViewer', and grant the corresponding permissions to each role. Then, you can add the auditors group to these custom roles to give them access to the required logs and data.
  4. droogie 👍 5
    You assume Auditors Group = External Auditors only. Auditors Group may contain both Internal and External Auditors.
  5. Nikimiki 👍 4
    The true evil is this question itself is so dumb, so American, so confusing.... two options A and C are both arguably correct on their own term. The big question is why this kind of vague, ambiguous questions show up in the exam to create confusion. It is not testing technical skill or knowledge, but it is starting a whole new philosophical debate! Another oddity is who has the golden key for all these questions? Who is showing you those "Correct Answer" when you click on the "Reveal Answer"? This nation is increasingly dumber and dumber!
  6. Bobbybash 👍 4 Answered B
    B.... The recommended practice for configuring IAM access audit logging in BigQuery is to create two custom IAM roles for auditors: one with the bigquery.datasets.get permission, and the other with the bigquery.tables.getData permission. You should then add the auditors group to these custom IAM roles. This will allow auditors to view metadata about datasets and access data within tables, while preventing them from performing other operations on the BigQuery resources. Therefore, option B is the correct answer.
  7. ArtistS 👍 4
    A is correct. 1st you should know this is a exam. Google recommend xxx means you should choose group first.
  8. Buruguduystunstugudunstuy 👍 3 Answered B
    I would say that Answer A is not the correct answer. While it is true that adding the auditor's group to the 'logging.viewer' and 'bigQuery.dataViewer' roles would allow them to view the logs and data in BigQuery, it does not enable IAM access audit logging. The correct answer is Answer B - Add the auditors group to two new custom IAM roles. You should create custom IAM roles with the necessary permissions to view IAM audit logs in BigQuery and assign those roles to the auditor's group. This follows the Google-recommended practice of using custom roles to grant least privilege access to resources. Answer C is incorrect because you should not add users' accounts to predefined IAM roles like logging.viewer or bigQuery.dataViewer. Predefined roles are meant to provide a general set of permissions for common use cases, and adding users or groups to them may grant them unnecessary access. Answer D is not the best practice as it is better to create separate custom IAM roles for each type of user rather than combining them.
  9. ESP_SAP 👍 3
    Correct asnwer is A: Based on : Delegate responsibility with groups and service accounts We recommend collecting users with the same responsibilities into groups and assigning IAM roles to the groups rather than to individual users.
  10. rafsrod 👍 3 Answered A
    A. Add the auditors group to the ג€˜logging.viewerג€™ and ג€˜bigQuery.dataViewerג€™ predefined IAM roles. Check: https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
  11. ankit89 👍 3
    Option A is correct, see document, https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations
  12. GCP_Student1 👍 3
    C is the correct option; https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
  13. vijay456 👍 3 Answered C
    there is no group created and no option syas create group too, so provided option C is suitable best answer
  14. Captain1212 👍 3 Answered A
    Google Recommended Practice A is the correct Answer add the users in the group then grant them the access
  15. poogcp 👍 3
    A is the correct one , as per google recommended practice , assign role to group instead of user
  16. red_panda 👍 3 Answered B
    B is correct. Is a best practice to prefer custom role, specially for external users.
  17. mlantonis 👍 3
    Correct is A as you use group and predefined roles.
  18. INASR 👍 2
    Correct is A. Scenario: External auditors (From Google Documents) In this scenario, audit logs for an organization are aggregated and exported to a central sink location. A third-party auditor is granted access several times a year to review the organization's audit logs. The auditor is not authorized to view PII data in the Admin Activity logs. To comply with this requirement, a dashboard is available that provides access to the historic logs stored in BigQuery, and on request, to the Cloud Logging Admin Activity logs. The organization creates a Google group for these external auditors and adds the current auditor to the group. This group is monitored and is typically granted access to the dashboard application.
  19. hems4all 👍 2
    Answer is A: Grant the auditors’ group roles/logging.viewer and roles/bigquery.dataViewer IAM roles. is the right answer. For external auditors, Google recommends we grant logging.viewer and bigquery.dataViewer roles. Since auditing happens several times a year to review the organization's audit logs, it is recommended we create a group with these grants and assign the group to auditor user accounts during the time of the audit. Ref: https://cloud.google.com/iam/docs/roles-audit-logging#scenario_external_auditors
  20. glanshima 👍 2
    Correct A The organization creates a Google group for these external auditors and adds the current auditor to the group. This group is monitored and is typically granted access to the dashboard application. see: https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
  21. Ravihonnagiri 👍 2
    Answer is A The organization creates a Google group for these external auditors and adds the current auditor to the group. This group is monitored and is typically granted access to the dashboard application.
  22. thewalker 👍 2 Answered A
    A Create a group with the auditors, grant 'logging.viewer' and 'bigQuery.dataViewer roles to the group on a table / view with the required data.
  23. Agraved 👍 2
    Answer has to be A, as per Google Best Practice and practically make sense. Would be useless to add individuals to roles one by one
  24. GCP_Student1 👍 2
    I will take it back answer is A A. Add the auditors group to the "˜logging.viewer' and "˜bigQuery.dataViewer' predefined IAM roles.
  25. pas77 👍 2
    You really didn't read the link you've provided. It clearly shows to add users to a group. Coinciding with option A.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Single Instance Managed Instance Group Configuration on GCP

S-grade

Authenticating On-Premises Apps to GCP AutoML APIs

S-grade

Consolidating Multi-Project Monitoring in One Stackdriver Dashboard

S-grade

How to Enable Cloud Pub/Sub API for App Engine

S-grade

Practice All ACE Questions

Access 84 questions with complete answers and detailed explanations.

View Full ACE Practice Test →

← Back to ACE Study Guide