Auditing BigQuery User Query Counts

Familiarity with Google Cloud Observability solutions.

Your BigQuery project has several users. For audit purposes, you need to see how many queries each user ran in the last month. What should you do?

Connect Google Data Studio to BigQuery. Create a dimension for the users and a metric for the amount of queries per user.
In the BigQuery interface, execute a query on the JOBS table to get the required information.
Use ג€˜bq showג€™ to list all jobs. Per job, use ג€˜bq lsג€™ to list job information and get the required information.
Use Cloud Audit Logging to view Cloud Audit Logs, and create a filter on the query operation to get the required information. Correct Answer

Answer Correct answer: D — Use Cloud Audit Logging to view Cloud Audit Logs, and create a filter on the query operation to get the required information.

Community Insight

The question tests the distinction between querying operational metadata for immediate data access versus using centralized audit logs for compliance and historical auditing.

This page clarifies how to audit BigQuery usage by identifying the correct method to count queries per user over a specific period, establishing that Cloud Audit Logging is the standard solution.

Many learners choose Option B because INFORMATION_SCHEMA.JOBS views are excellent for real-time monitoring, but they often lack the retention and security guarantees required for formal audit trails compared to Cloud Audit Logs.

Community Discussion (135 comments)

0d8df8b 👍 2 Selected: B

The task is to find out how many queries each user executed over the past month. BigQuery stores job metadata in the INFORMATION_SCHEMA.JOBS views.

Johnb9682 👍 1 Selected: D

Answer is D. Reason: Cloud Audit Logs are the official and definitive source for audit purposes.

hitmax87 👍 1

Audit Logs is used to identify who and when performed actions on GCP infrastructure. Correct answer is B

acloudboy 👍 1 Selected: D

Answer is D. Reason: Cloud Audit Logs are the official and definitive source for audit purposes.

Pime13 👍 1 Selected: D

Comprehensive Tracking: BigQuery automatically integrates with Cloud Audit Logs, which record every API call and operation, including query execution (job creation). This provides a reliable, tamper-proof history of all user activity required for formal audits. Granular Filtering: Within the Cloud Logging interface, you can use the Log Explorer to create specific filters. By filtering for the google.cloud.bigquery.v2.JobService.Insert method and the query operation over a specific time range (the last month), you can accurately group and count the total number of queries initiated by each individual user identity (principalEmail).

Pime13 👍 1

Scale and Retention: Unlike manual listing commands or direct table queries, Cloud Audit Logs are designed to handle millions of events and offer customizable retention periods suitable for long-term compliance and historical analysis.

CyberPeter 👍 1 Selected: B

BigQuery keeps metadata about all jobs (including queries) in its job history tables. You can query these (for example via INFORMATION_SCHEMA.JOBS*) to: Filter to the last month Group by user (principal_email) Count the number of QUERY jobs This is the standard, auditable, and exam-expected way to answer questions like “how many queries did each user run?”

KCjoe 👍 3 Selected: B

Google Cloud's BigQuery service automatically logs metadata about every job run in your project into system tables for up to 60 days. This makes auditing query usage straightforward using standard SQL queries.

ast3citos 👍 3 Selected: B

Apparently while D is historizally correct and gets you the data you are looking for, B is the more modern approach introduced by Google to query for jobs metadata.

eIon_musk 👍 2 Selected: B

simpest and cheapest

JoseCloudEng1994 👍 2 Selected: B

For audit and security purposes, the definitive source of truth for all activity in a Google Cloud project is Cloud Audit Logs. BigQuery automatically generates audit logs that record a wide range of activities, including when a user runs a query. This approach is the most reliable because: It's the official, comprehensive audit trail for your project. You can filter logs by methodName: "google.cloud.bigquery.v2.JobService.Query" to specifically target query jobs. The logs contain metadata about the user who initiated the job, the timestamp, and other details necessary for your audit.

JoseCloudEng1994 👍 1

B. In the BigQuery interface, execute a query on the JOBS table to get the required information. ❌ This option is close but refers to a non-existent "JOBS table" in the traditional sense. The correct way to query job metadata within BigQuery itself is to use the INFORMATION_SCHEMA.JOBS view. This view contains metadata about all jobs (queries, loads, etc.) run in the project. You can query this view to get the number of queries per user. However, this is for performance analysis and monitoring, and while it can be used for audits, Cloud Audit Logs are the official and definitive source for audit purposes.

rajrocks171 👍 4 Selected: D

Option D. Cloud audit logs track all BiqQuery jobs including who ran each query, when and how. You can filter logs by operation type and group by user identity. Not Option B - Unless you are a project admin, by default JOBS table shows jobs for the current user. Also, retention period here is 7 days.

lokiinaction 👍 3 Selected: D

Audit log (exported to BQ) is source for audit trails and security, includes full SQL text, can be retained for very long periods if exported.

markware 👍 3 Selected: D

This is mentioned in Engineer course from Google

francisco94 👍 3 Selected: D

I agree B could be the solution, but the best option is D. This is the correct and scalable approach: Cloud Audit Logs capture who ran what, including queries. You can filter on methodName = "jobservice.jobcompleted" and analyze logs in Logs Explorer or export to BigQuery for querying. Supports organization-wide, project-wide, and per-user visibility.

Mikeliz 👍 2 Selected: B

B is the better answer. You get more logs relating to BigQuery jobs from BigQuery than you get from Cloud Audit Logs

david_tay 👍 2 Selected: B

B is correct. Go search in Gemini "what are the steps to execute a query on the JOBS table in Bigquery to see how many queries each user ran in the last month." to see how easy are the steps.

PetarMarinkovic 👍 3 Selected: D

D is the right answer

david_tay 👍 3 Selected: B

answer is B, fastest and efficient method. Question said that they just need to know "how many queries each user ran in the last month" which B can do in a short time.

1P5811 👍 4 Selected: B

BigQuery's INFORMATION_SCHEMA: BigQuery provides metadata about datasets, tables, and jobs through the INFORMATION_SCHEMA. The JOBS_BY_USER view within this schema is specifically designed to give you information about jobs run by each user. You can easily query this view to get the number of queries run by each user in the last month.

alpay 👍 3 Selected: D

"Audit logs versus INFORMATION_SCHEMA views Audit logs help you answer the question "Who did what, where, and when?" within your Google Cloud resources. Audit logs are the definitive source of information for system activity by user and access patterns and should be your primary source for audit or security questions." https://cloud.google.com/bigquery/docs/introduction-audit-workloads

nareshthumma 👍 2

Answer is B In the BigQuery interface, execute a query on the JOBS table to get the required information. Explanation: JOBS Table:BigQuery automatically logs job information, including queries, in a special table called JOBS. By querying this table, you can retrieve details about each job, including the user who ran it, the query text, and the timestamp. Why the Other Options Are Less Suitable: Connect Google Data Studio to BigQuery: While this can visualize data, you still need to execute a query to pull the data first. This option is not directly querying for the information you need. Use ‘bq show’ and ‘bq ls’: These commands provide metadata about jobs but do not efficiently retrieve the count of queries per user, especially for a large number of jobs over a month. Use Cloud Audit Logging: This approach could work but would be more complex and less efficient for simply counting queries. The JOBS table is specifically designed for this purpose, making it easier to extract the necessary data.

awsgcparch 👍 7 Selected: B

Using the INFORMATION_SCHEMA.JOBS_BY_USER table within BigQuery is the most efficient and straightforward method to get the required audit information about the number of queries each user ran in the last month. Therefore, option B is the best choice.. D.While Cloud Audit Logs can provide detailed logs of activities, querying them directly for this purpose is less efficient than using the JOBS table in BigQuery. Additionally, setting up and querying audit logs involves more steps and may require exporting logs to BigQuery for complex queries.

awsgcparch 👍 6 Selected: B

Why B is the Best Answer: Direct Access to Job Metadata: BigQuery maintains metadata about jobs (including query jobs) in the INFORMATION_SCHEMA views, specifically in the INFORMATION_SCHEMA.JOBS table. Detailed Information: This table contains information about all jobs, including who ran them, when they were run, and the type of job. This makes it easy to filter and count queries by user. Querying JOBS Table: You can write a SQL query to count the number of queries executed by each user over the specified period.

eff12c1 👍 7 Selected: B

Querying the INFORMATION_SCHEMA.JOBS_BY_USER view in BigQuery is the most efficient and straightforward way to obtain the number of queries each user ran in the last month. This method leverages built-in BigQuery capabilities designed specifically for auditing and monitoring query jobs. Cloud Audit Logs provide detailed logging information but are more complex to query for specific metrics like the number of queries run by each user. BigQuery’s INFORMATION_SCHEMA.JOBS_BY_USER is designed for this purpose and is easier to use for querying job data.

JaimeMS 👍 1 Selected: D

Audit logs, Option D

AhmedSami 👍 1 Selected: C

reason: https://cloud.google.com/logging/docs/audit#data-access Data Access audit logs—except for BigQuery Data Access audit logs—are disabled by default because audit logs can be quite large. If you want Data Access audit logs to be written for Google Cloud services other than BigQuery, you must explicitly enable them

SSS987 👍 2

I finally decide to go with Option D over B because we or the auditor might not have access to the metadata. In fact, in our project, not all of us had access to query this view. "To get the permission that you need to query the INFORMATION_SCHEMA.JOBS view, ask your administrator to grant you the BigQuery Resource Viewer" https://cloud.google.com/bigquery/docs/information-schema-jobs#required_role. (And not because of the wordings "Table" instead of "view" - don't think an architect exam will try to assess your memory of whether it is a table or a view or your understanding of the difference between a table and a view).

PhatLau 👍 3 Selected: D

C - bq show: To view job details (https://cloud.google.com/bigquery/docs/managing-jobs#view_job_details_2) bq ls: To list jobs (https://cloud.google.com/bigquery/docs/managing-jobs#list_jobs) So D is the correct one.

zaxxon 👍 1 Selected: C

https://cloud.google.com/bigquery/docs/managing-jobs#list_jobs_in_a_project

muh21 👍 1

I think B is the correct answer

TheCloudGuruu 👍 1 Selected: D

Cloud Logging

VarunGo 👍 7 Selected: B

B is correct. here's the link - https://cloud.google.com/bigquery/docs/information-schema-jobs

medi01 👍 3 Selected: B

JOBS system table does exist and it contains exactly the info we need: one record for each job executed by users (query is one of the type of the jobs)

Ric350 👍 1

Yes, but this is assuming you have the required role of BigQuery Resource Viewer which is needed and does not clarify in the question! So does that make D the right answer? And with D, you need the logs viewer role. The question is a bad one as it doesn't clarify any roles in this scenario.

JC0926 👍 4 Selected: D

D. Use Cloud Audit Logging to view Cloud Audit Logs, and create a filter on the query operation to get the required information. Cloud Audit Logging records activities and API calls in Google Cloud services, including BigQuery. You can use Cloud Audit Logging to view logs and filter them based on specific operations, such as queries in BigQuery. By filtering on the query operation, you can gather the required information about how many queries each user ran in the last month, which is essential for audit purposes.

gcppandit 👍 5 Selected: D

A is not possible. B is possible if VIEW is used instead of TABLE in the description. I use this view to get this information regularly. C. I have no cloud how this can be right answer. D. Only possible as per text descriptions.

medi01 👍 2

JOBS being read-only for the user doesn't make it a view.

foward 👍 2 Selected: D

d is correct

morffi 👍 1

Option A: Why would this not provide correct information? You could show the content of the JOBS view. : SELECT user_email, CAST(creation_time as DATE) as date, count(*) as queries_per_day FROM region-eu.INFORMATION_SCHEMA.JOBS WHERE creation_time BETWEEN TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 45 DAY) AND CURRENT_TIMESTAMP() AND job_type = 'QUERY' group by user_email, CAST(creation_time as DATE)

omermahgoub 👍 5

The correct answer is D. Use Cloud Audit Logging to view Cloud Audit Logs, and create a filter on the query operation to get the required information. Google Cloud's Cloud Audit Logging service allows you to view, search, and export audit logs for your Google Cloud projects. These audit logs contain information about the actions that are performed in your project, including queries that are run in BigQuery. To see how many queries each user ran in the last month, you can use Cloud Audit Logging to view the Cloud Audit Logs for your BigQuery project. Then, you can create a filter on the query operation to see only the queries that were run. You can also create a filter on the user field to see the queries that were run by each user. This will allow you to see the number of queries that were run by each user in the last month, which can be useful for audit purposes.

omermahgoub 👍 7

Option A, connecting Google Data Studio to BigQuery and creating a dimension for the users and a metric for the amount of queries per user, is a valid method of visualizing data, but it would not provide the specific information about the number of queries that were run by each user in the last month. Option B, executing a query on the JOBS table to get the required information, is not a viable option because the JOBS table does not contain information about the user who ran the query. Option C, using the 'bq show' and 'bq ls' commands to list job information, is not a viable option because these commands do not provide information about the user who ran the query.

surajkrishnamurthy 👍 1 Selected: D

D is the correct answer

megumin 👍 2 Selected: D

D is ok

ErenYeager 👍 1 Selected: A

D is not the answer there was no mention about exporting to bigquery. A is correct 😎

Mahmoud_E 👍 1

D likely the answer, if B says view I would have selected B, but it says table while its a view

minmin2020 👍 2 Selected: D

D. Use Cloud Audit Logging to view Cloud Audit Logs, and create a filter on the query operation to get the required information.

abdelilahfa 👍 1

I think the right answer is B https://cloud.google.com/bigquery/docs/information-schema-jobs

zr79 👍 1

For audit purposes, you need to see how many queries each user ran in the last month. This is an example of Cloud Audit log for admin activity

6721sora 👍 3 Selected: B

B since the JOBS view provides this information and is much simpler

kiappy81 👍 1

the point is that JOBS is not a table, but rather a view. For this reason you have to select option audit log.

6721sora 👍 1 Selected: B

B and D are both viable. But B is simpler and out of the Box. D requires creating filters in Audit logs.

ijazahmad722 👍 3

The query is listed here on the page , Correct annswr is B https://cloud.google.com/bigquery/docs/information-schema-jobs

ijazahmad722 👍 3

I found this in google practice exam and the answer is B

DrishaS4 👍 2 Selected: D

https://cloud.google.com/bigquery/docs/reference/auditlogs#ids

AzureDP900 👍 1

Yes, D is correct. Use Cloud Audit Logging to view Cloud Audit Logs, and create a filter on the query operation to get the required information.

blitzzzz 👍 1 Selected: D

select D

OrangeTiger 👍 2

I vote D. Actibity log is automatically logged. We can confirm this on CloudConsole.

vincy2202 👍 1 Selected: D

D is the correct answer. Its between B & D. 1.Option B could have been the correct answer if the JOBS was not referred as "Table" rather as a "View" whihc are a part of INFORMATION_SCHEMA. Ref - https://cloud.google.com/bigquery/docs/information-schema-jobs#schema 2. D is the most suited choice, since the BigQuery leverages Cloud Audit logs for admin, data access & system events. Ref - https://cloud.google.com/bigquery/docs/reference/auditlogs#overview

ABO_Doma 👍 2 Selected: D

The bq show command displays information about an object. It can't be used to list all jobs. https://cloud.google.com/bigquery/docs/reference/bq-cli-reference#bq_show As described in the syntax here: https://cloud.google.com/bigquery/docs/managing-jobs#bq, bq show needs a job id (which we don't have) to show the details of the job.

ABO_Doma 👍 1 Selected: D

D is correct

gcp_learner 👍 1 Selected: D

Cloud Audit Log is right answer to the question

PhilipKoku 👍 1 Selected: D

Audit logs is the answer

haroldbenites 👍 1

Go for D

pakilodi 👍 1 Selected: D

D is right here.

joe2211 👍 1 Selected: D

vote D

ravisar 👍 1

I would be surprised if we need to go through the audit logs to count number of queries by users. So D seems to be not correct. I agree that this information may be available in logs, but We may have better way to query this.

ravisar 👍 1

Is this the job table ? google.cloud.bigquery.job.QueryJob ? https://googleapis.dev/python/bigquery/latest/generated/google.cloud.bigquery.job.QueryJob.html Looks like answer is B

MaxNRG 👍 1

D – Use Cloud Audit Logging to view Cloud Audit Logs and create a filter on the query operation to get required info. See Audit Logs for BQ, there is example of similar log query in the end of this page – Most Popular Datasets (statistics about table reads/modifications). https://cloud.google.com/bigquery/docs/reference/auditlogs/ Types of Audit Logs are described here: https://cloud.google.com/logging/docs/audit/ - this Q refers to Data Access audit logs. A - option maybe also considered as an answer, since DataStudio integrates with BQ. But, DataStudio is used just for data visualization, helps to analyze data interactively.

amxexam 👍 1

Please don't go with the flow as everyone in the post is going, if you are using a big query you will know you can self query all details about your query execution. Jobs and all are direct. But if you need additional information like slots used and all then you need to sink bigquery logs to bigquery table to query upon.

amxexam 👍 1

Will go with B

AshwathD 👍 6

It is B. ex: SELECT project_id, user_email,count(*) as CNT FROM region-us.INFORMATION_SCHEMA.JOBS group by project_id, user_email ;

Ric350 👍 1

So do you assume B has the required role of BigQuery Resource Viewer? Because without it, the user can't run the query.

Papafel 👍 2

Answer is D for sure!

victory108 👍 4

D. Use Cloud Audit Logging to view Cloud Audit Logs, and create a filter on the query operation to get the required information.

Ausias18 👍 2

answer is D

lynx256 👍 4

There is no JOBS table in the INFORMATION_SCHEMA - so B is not correct. (ref: https://cloud.google.com/bigquery/docs/information-schema-jobs#schema) C needs some extra effort -- so it isn't so good. IMO D is correct. "BigQuery automatically sends audit logs to Cloud Logging" (ref: https://cloud.google.com/bigquery/docs/reference/auditlogs#stackdriver_logging_exports) Ref: https://cloud.google.com/logging/docs/audit Ref: https://cloud.google.com/logging/docs/audit#viewing_audit_logs

pawel_ski 👍 3

The retention period for the data access audit logs is 30 days. So you can’t get the information about queries each user ran in the LAST MONTH. D is incorrect. B is incorrect because of the word TABLE instead of VIEW. But when you assume that they ask about views JOBS_BY* the solution is ok for a one time action. You run once the query, get the result, present it to someone and … forget ;-). When you need to use it every month and present it to someone better is prepare something more permanent. In such case I would use Data Studio chart based on a data source: Custom Query from BQ. I did this in practice and it works. For me answer A looks correct, but it misses expression “use Custom Query as a data source” So we can’t be sure in 100%. ;-) https://cloud.google.com/bi-engine/docs/getting-started-data-studio

lynx256 👍 1

Ad. "The retention period for the data access audit logs is 30 days. " - yes, but it's configuravble. Ref: https://cloud.google.com/logging/quotas#logs_retention_periods None of the options deal with retention except B... If there in B was JOBS% table, it would've been correct. But there is no % after JOBS so IMO it is not corect...

CloudGenious 👍 1

D is right

bnlcnd 👍 1

Can anyone explain why B is not right? https://cloud.google.com/bigquery/docs/information-schema-jobs Is it just because the wording "JOBS table" is not precise? the JOBS_BY_* view can provide all the information. And it is easier that C (if worded properly) and much easier than D.

bnlcnd 👍 1

Seems both C and D work. Any reason it's one or the other?

mwilbert 👍 1

This question is annoying because there are multiple approaches that could work. I'd go with D as this is an audit function, but I don't think it is clearcut.

Prakzz 👍 2

Its D...It is explained in brief in Linux Academy Data Engineer course

BhupalS 👍 2

D seems the right https://cloud.google.com/bigquery/docs/reference/auditlogs#auditdata_examples

Chulbul_Pandey 👍 1

D is the ans

Archy 👍 1

B as, Retrieving jobs metadata by using INFORMATION_SCHEMA tables requires appropriately-scoped permissions: JOBS_BY_USER requires bigquery.jobs.list for the project and is available to the Project Viewer and BigQuery User roles. INFORMATION_SCHEMA.JOBS_BY_* view to retrieve real-time metadata about BigQuery jobs. This view contains currently running jobs, as well as the last 180 days of history of completed jobs.

IanR7 👍 1

But the answer mentions the "JOBS" table ?

OSNG 👍 3

B is correct. Please refer to "INFORMATION_SCHEMA.JOBS_BY_USER" https://cloud.google.com/bigquery/docs/information-schema-jobs#schema Examples: https://cloud.google.com/bigquery/docs/information-schema-jobs#examples

lynx256 👍 2

But the opt. B mentions the "JOBS" table, not JOBS_BY_USER

W0olf 👍 1

Must be D imho https://cloud.google.com/bigquery/docs/reference/auditlogs

akhadar2001 👍 2

C is the correct answer..

zh31427 👍 3

I think it's an outdated question. the easiest way is to use the console to query the metadata table. I am only guessing that the INFORMATION_SCHEMA table used to be called JOBS and hterefore the correct answer was B. Let's hope exam questions are up to date. https://cloud.google.com/bigquery/docs/information-schema-jobs

VedaSW 👍 1

Ok, assuming both B and D can meet the requirements of getting the user activities. The question is explicitly stated for "audit purpose". Usually, it will means get the data from central logging (if this option is available). (as the auditor may audit other areas as well) So, I guess, D maybe is a better answer?

JyoGCP 👍 1

Confused between B and D. Can we directly get the count (queries ran) per user from "Cloud Audit Logs"? Or should we export logs to BQ and then get the count?

AshokC 👍 2

D is the correct

wiqi 👍 1

I would go with D. https://cloud.google.com/logging/docs/view/overview

haidertanveer0808 👍 1

B seems correct. Viewing job data You can view job data and metadata by using the Cloud Console, the classic web UI, command-line interface, and API. This data includes details such as the job type, the job state, and the user who ran the job.

haidertanveer0808 👍 2

changing to C.

alii 👍 4

yep, D is right, https://cloud.google.com/bigquery/docs/reference/auditlogs#data_access_data_access

mlantonis 👍 1

My choice is Cloud Audit Logs, but I am not sure. Confused

Kunalkmehta08 👍 3

Data access audit logs are enabled for BQ by default

Erso 👍 1

after all, optimizing-costs is not a requirement

rehma017 👍 3

The answer is B actually, not sure why everyone is so clueless - read this page under required permissions bigquery.admin: https://cloud.google.com/bigquery/docs/managing-jobs

pf38120 👍 2

I agree that B seems logical, but it costs money whereas D is free of charge

Ziegler 👍 3

D is the correct answer for me https://cloud.google.com/bigquery/docs/reference/auditlogs#example_most_popular_datasets

rehma017 👍 1

Actually you are wrong, read those docs again, B is correct, bigquery.admin allows a user to see jobs from all users.

AD2AD4 👍 7

Final Decision to go with Option D as per https://cloud.google.com/bigquery/docs/reference/auditlogs#example_query_cost_breakdown_by_identity

CoolCat 👍 1

But data access audit logs are disabled by default .... And u need to enable this functionality before u can get these audit logs...see here https://cloud.google.com/logging/docs/audit

bnlcnd 👍 2

Finally. this details is exactly why C is not right. LOL. change my mind from C or D to D only.

GunjGupta 👍 4

Big query by default logs into cloud logging. we can add a filter to get data groups by users for specific months. This seems to be a more efficient way of getting data. I will go for option D

Zarmi 👍 27

Answer is D: https://cloud.google.com/bigquery/docs/reference/auditlogs#example_query_cost_breakdown_by_identity

ErenYeager 👍 2

No mention about exporting to bq

BobbyFlash 👍 3

Nailed it

zazza52 👍 2

Answer is A : Visualize GCP Billing using BigQuery and Data Studio https://medium.com/google-cloud/visualize-gcp-billing-using-bigquery-and-data-studio-d3e695f90c08

Ayzen 👍 4

If you read the blog post carefully you can notice that before starting analyzing data in Data Studio they import data from Stackdriver logs (basically, cloud audit logs). Since the task was not to create a beautiful charts, I'd go directly to audit logs.

Googler2 👍 54

D- reasons: 1.-Cloud Audit Logs maintains audit logs for admin activity, data access and system events. BIGQUERY is automatically send to cloud audit log functionality. 2.- In the filter you can filter relevant BigQuery Audit messages, you can express filters as part of the export https://cloud.google.com/logging/docs/audit https://cloud.google.com/bigquery/docs/reference/auditlogs#ids https://cloud.google.com/bigquery/docs/reference/auditlogs#auditdata_examples

heretolearnazure 👍 3

Answer is D

GooglecloudArchitect 👍 10

D is the right as you can get the monthly view of the query usage across all the users and projects for auditing purpose. C does need appropriate permission to see the detail level data. Monthly view is tough to get directly from the bq ls or bq show commands.

mawsman 👍 3

B. I say that since you can query bigquery.jobs table with the client libraries and query for the time range of last month.The correct CLI syntax would be bq ls -a -j -max_creation_time <max-age-in-unix-time> project-name. The -a would simply list all jobs and the -j will limit the age to what ever the unix date of the first day of the month in question was. The bq show command just examines the shcema so answer C is not correct.

AD2AD4 👍 1

Its only for a specific user - refer https://cloud.google.com/bigquery/docs/managing-jobs

natpilot 👍 1

Agree C. by cosnole it's can be done by "query history"

checkmate 👍 4

In the CLI, you can run bq ls -j -a to retrieve jobs for all users in a project. Then you can run for each job id a bq show -j <job_id> and in order to have more details you will choose to use the json response: Hence, C is not right, Use bq ls to list all jobs, use bq show to show the detail.

AWS56 👍 3

Agree C

checkmate 👍 13

Please see the C carefully, it should be Use bq ls to list all jobs, use bq show to show the detail. Hence C is not right.

Dannyygcp 👍 10

Yes..D is correct

gavintgh 👍 2

if all agree C, why the answer is saying B here?

jobs 👍 3

True C is right: https://stackoverflow.com/questions/43688885/get-queries-executed-on-bigquery-by-user

shandy 👍 4

C is right. https://stackoverflow.com/questions/30993782/how-retrieve-the-user-and-sql-code-associated-with-a-bigquery-job/30995665#30995665

jamjam2020 👍 2

run bq ls -j -a to retrieve jobs run for each job id a bq show -j <job_id> and in order to have more details the cmd options other way round in option C ?

KouShikyou 👍 6

I think C is correct.

nitinz 👍 1

D is correct

kumarp6 👍 4

Try audit logs, D is OK

tartar 👍 12

D is ok

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Cloud Audit Logging (Option D) is the definitive tool for auditing administrative and data access activities in Google Cloud. BigQuery automatically sends audit logs to Cloud Logging, allowing you to filter for specific query operations and aggregate counts by user identity over time. This approach provides a secure, immutable record suitable for compliance.

Why the Other Options Are Wrong

Option A relies on Data Studio, which is a visualization layer dependent on underlying data sources; it does not inherently provide an audit log mechanism. Option B suggests querying the JOBS table directly; while INFORMATION_SCHEMA.JOBS_BY_USER is useful for current or recent job visibility, it is not designed as a long-term audit trail and may be subject to retention limits. Option C involves command-line tools like bq ls and bq show, which are interactive and not scalable for monthly aggregation across many users.

Community Comment Notes

The community was split between Option B and D. Several commenters argued that INFORMATION_SCHEMA is 'more efficient' for getting query counts, noting that it is a built-in feature for monitoring. However, others pointed out that Cloud Audit Logs are specifically designed for 'audit purposes' and provide a broader view of activity including permissions and system events, making D the more robust answer for compliance scenarios.

Official Reference

Exam Strategy

When a question specifies 'audit purposes' or 'compliance', prioritize solutions that involve centralized logging (like Cloud Audit Logs or Stackdriver) over direct database queries, as audit logs are immutable and retained for longer periods.

Frequently Asked Questions

Why is INFORMATION_SCHEMA.JOBS_BY_USER not the best choice for auditing?

While useful for monitoring, INFORMATION_SCHEMA tables are not retained as long as audit logs and are not considered an immutable audit trail for compliance.

Can I use bq ls to count monthly queries per user?

No, bq ls lists jobs interactively and is not practical for aggregating historical data across multiple users and months programmatically.

More PCA FAQ →

Related Analysis

Practice All PCA Questions

Access 81 questions with complete answers and detailed explanations.

View Full PCA Practice Test →

← Back to PCA Study Guide