Streamlining Cloud IAM Audit Analysis with BigQuery
Designing for security.
Auditors visit your teams every 12 months and ask to review all the Google Cloud Identity and Access Management (Cloud IAM) policy changes in the previous 12 months. You want to streamline and expedite the analysis and audit process. What should you do?
Answer
Correct answer: B — Enable Logging export to Google BigQuery and use ACLs and views to scope the data shared with the auditor.
Community Insight
The core concept is secure log analysis; the common trap is choosing cheaper storage (GCS) over a query engine (BigQuery) when the requirement explicitly emphasizes streamlining and expediting the analysis process rather than just minimizing cost.
This question addresses the best practice for exporting and analyzing Google Cloud IAM audit logs to streamline annual audits. The correct approach leverages Google BigQuery for its powerful SQL querying capabilities, allowing auditors to efficiently analyze policy changes without managing raw log files.
Many learners select Option D (GCS export) because it is cheaper and suitable for long-term retention. However, GCS stores logs as unstructured text files, making manual or script-based analysis significantly slower and more complex compared to the structured SQL queries available in BigQuery, which directly contradicts the goal of 'expediting' the review.
Community Discussion (191 comments)
PRAVEEN2512
👍 1
Selected: B
b is correct
ahmed75.zahran00
👍 1
Selected: B
expedite the analysis and audit process means B Minimize cost D
hpf97
👍 1
Selected: B
A : not good as sending security data outside, even for audit, is not compliant C : cloud SQL is not designed for audits D : Would be great as the linly one to mention audit logs but only the log from GCS, and not IAM. B : remaining answer but it would be prefered audit log
ramjisriram
👍 4
Selected: B
Key clue from the question is "You want to streamline and expedite the analysis". How can you expect streamline and analysis capabilities from Cloud Storage? Rather BigQuery has the analytics and streamline capabilities inbuilt in the tool. User access can be controlled in both, so the correct answer with key clues is to Enable Logging export to Google BigQuery (this will store all the logs streamlined) and use ACLs (these are filters, so according to the audior) and views (these are read only, there is no obfuscation or tokenization or sensistive data to be handled from the logs !!!!) to scope the data shared with the auditor.
Ishu_awsguy
👍 1
Selected: B
The power word here is , Streamline analysis and audit , hence BQ is the answer. If it would have been only audit , then D would have been beteer
Ekramy_Elnaggar
👍 4
Selected: B
1. Comprehensive Audit Trail: Cloud Logging automatically captures audit logs for all Cloud IAM activity. Exporting these logs to BigQuery provides a centralized and comprehensive audit trail for analysis. 2. Powerful Analysis: BigQuery's analytical capabilities allow auditors to efficiently query and analyze IAM policy changes over the 12-month period. They can filter, aggregate, and generate reports to identify any anomalies or security concerns. 3. Granular Access Control: BigQuery's Access Control Lists (ACLs) and views enable you to precisely control which data the auditors can access. This ensures that they only see the information relevant to their audit without exposing sensitive data. Note: While exporting logs to Cloud Storage is possible, it's less efficient for analysis compared to BigQuery.
nareshthumma
👍 1
Answer B
maxdanny
👍 1
Selected: B
Option B is the best approach. Enable Logging export to Google BigQuery and use ACLs and views to scope the data shared with the auditor. This method provides robust querying capabilities, ensures that historical IAM policy changes can be analyzed effectively, and allows you to control access securely.
joecloud12
👍 1
Selected: B
b is correct because it is easier to implement compared to D
H_S
👍 4
Selected: D
READ THIS, ACL is not available in BIG QUERY , thereforeD. Enable Google Cloud Storage (GCS) log export to audit logs into a GCS bucket and delegate access to the bucket
Jen3
👍 1
ACLs would provide year-round access to the data which is more privileges than necessary. Logs will need to be retained for a full year because hypothetically, January logs could be looked at in December. Cloud Storage offers signed URLs, and less expensive storage options.
lisabisa
👍 1
Both B and D are ok. Using cloud storage requires additional setup for auditors, pulling data to BQ. Using BQ would satisfy "streamline and expedite the analysis and audit process"
Teckexam
👍 4
Selected: B
Based on google documentation B is the correct answer. https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors Dashboard is available in BigQuery to review historic logs and in case anamoly is found elevated access is provided. Access is revoked after audit activities are done.
kip21
👍 2
D - Correct B - his option requires additional work to set up the ACLs and views to limit an auditor's view of the data. This could be time-consuming and complex to implement. Furthermore, BigQuery may not be the ideal tool for auditors who are only interested in reviewing Cloud IAM policy changes.
CloudDom
👍 1
Selected: B
That‘s the only logical one also Bard is confirming this one
thewalker
👍 3
D I will not go with B, as the requirement is once for 12 months. Push the data in Coldline for 12 months and retrieve it during audit is enough. Save costs.
hogtrough
👍 2
Streamline and expedite analysis is the goal. Costs are never brought up.
thewalker
👍 2
Coldline / Archive
krisek
👍 2
Selected: B
Reading from Cloud Storage raw audit logs (without filtering applied) is everything but streamlined. Imagine the auditor fetching all audit logs, then write some script to analyze them...
Prakzz
👍 4
Selected: D
B talks about ACL in BigQuery and ACL is not associated with BigQuery but with GCS.
AdityaGupta
👍 1
Selected: B
You want to streamline and expedite the analysis and audit process. Big Query, as the data retention is mentioned, and data is related to Cloud IAM policy changes, it is safe to assume long term retention with annual audit.
TopTalk
👍 1
Selected: B
``To comply with this requirement, a dashboard is available that provides access to the historic logs stored in BigQuery, and on request, to the Cloud Logging Admin Activity logs. The organization creates a Google group for these external auditors and adds the current auditor to the group. This group is monitored and is typically granted access to the dashboard application. During normal access, the auditors' Google group is only granted access to view the historic logs stored in BigQuery. If any anomalies are discovered, the group is granted permission to view the actual Cloud Logging Admin Activity logs via the dashboard's elevated access mode. At the end of each audit period, the group's access is then revoked.'' https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
smlabonia
👍 1
Selected: D
Auditors don't have why know how make BigQuery queries. They usually ask for evidence files.
Demo_Helloworld
👍 1
Selected: B
Sorry B is the Correct Answer
Demo_Helloworld
👍 1
Selected: D
Here they didnt asked about analysis so answer is D
tes1298t
👍 2
It is mentioned here that "Cloud Storage is the destination for long term storage of audit logs". So, going with D https://cloud.google.com/iam/docs/job-functions/auditing#scenario_operational_monitoring
claorden
👍 2
Selected: B
https://cloud.google.com/iam/docs/roles-audit-logging#scenario_external_auditors
jlambdan
👍 2
Selected: B
B with partitioned table expirering after 12 month
jlambdan
👍 1
Selected: D
D with partitioned table in order to retain only the latest 12 months.
jlambdan
👍 1
please moderator do not publish the comment above, It is supposed to be B, not D. I mixed them up. Thanks.
Atanu
👍 1
Selected: D
D is ok and a cheaper solution to the requirement.
FigVam
👍 1
Selected: B
should be b, given requirements.
ggroin
👍 1
Selected: B
B is correct
mifrah
👍 1
B: You want to streamline and expedite the analysis and audit process. For me the expedite the analysis is the key part --> BQ and not GCS.
JC0926
👍 1
Selected: D
The auditor can access the GCS bucket directly to review and analyze the logs without any intervention from your team. This approach is easy to set up, scalable, and ensures that the auditor has access to all the relevant data without any data loss.
BeCalm
👍 3
Selected: B
I think the answer is B because B explicitly mentions views and scope -- basically filtering the raw logs to control what the auditor sees(remove PII) vs. accessing raw logs in GCS.
BeCalm
👍 1
Selected: D
Lot easier to export to GCS vs. BQ.
yjring
👍 2
B. Enabling Google Cloud Storage (GCS) log export to audit logs into a GCS bucket and delegating access to the bucket may be an option, but it would require additional configuration and management, and may not provide the same level of queryability as BigQuery.
Jeena345
👍 1
Selected: B
It is B
KirtiMohanta
👍 1
Answer should be B
preman
👍 4
The question specifically mentions ' to expedite the Analysis and Auditing process' . Normally for storage scenarios option D with GCS would suffice---but in this scenario since we also need expedited analysis---the any solution involving BQ is preferred. Correct Answer - B.
Jerry_Yang
👍 2
D. Use only one per year. BigQuery is too much in this case.
omermahgoub
👍 2
D. Enable Google Cloud Storage (GCS) log export to audit logs into a GCS bucket and delegate access to the bucket To streamline and expedite the audit process, you can enable Google Cloud Storage (GCS) log export for Cloud IAM audit logs and store them in a GCS bucket. This will allow you to easily access and review the audit logs for the previous 12 months when auditors visit your team. You can then delegate access to the GCS bucket to the auditors, which will allow them to review the logs as part of their audit process. Other options, such as creating custom Google Stackdriver alerts or using cloud functions to transfer log entries to Google Cloud SQL, may not provide the necessary level of detail or accessibility for the audit process. Enabling Logging export to BigQuery and using ACLs and views to scope the data shared with the auditor may not be the most efficient approach for auditors to review the logs.
Sukhi4fornet
👍 5
D is the correct answer as it is cost effective B is correct if frequency is more like several times a year which is mentioned in below mentioned link https://cloud.google.com/iam/docs/roles-audit-logging#scenario_external_auditors
AniketD
👍 2
Selected: B
Correct answer is B. BigQuery would expedite the analysis
megumin
👍 1
Selected: B
B is ok
Aninina
👍 1
Selected: B
I think it's B https://cloud.google.com/iam/docs/roles-audit-logging#scenario_external_auditors
Mahmoud_E
👍 4
D for long term and just once a year audit, this post is for several audits a year https://cloud.google.com/iam/docs/roles-audit-logging#scenario_external_auditors
gonlafer
👍 1
Agree. It's D for that reason that makes a big difference in terms of cost.
zr79
👍 2
D. Enable Google Cloud Storage (GCS) log export to audit logs into a GCS bucket and delegate access to the bucket It is there to confuse us. How can you export GCS logs to audit logs? B is the correct answer
minmin2020
👍 3
Selected: B
B. Enable Logging export to Google BigQuery and use ACLs and views to scope the data shared with the auditor. B is a neater solution as they are looking to streamline and expedite the audit process compared to D thats is a cheaper solution and not as neat.
BiddlyBdoyng
👍 1
If you delete access to the Bucket how are the auditors meant to access it?
shekarcfc
👍 2
Selected: D
D, is the Answer.. the scenario presented in cloud.google.com don't have the condition of 12months.
gee1979
👍 1
agreed D... but don't you think this option would give external auditors access to all the logs?
aut0pil0t
👍 3
Selected: B
B: https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors
midgoo
👍 4
Selected: D
D is good and cheap. If I am an external Auditor, I will love D. Just pass me the file, why force me to use GCP BigQuery? B would mean the Auditor must use BigQuery to query the data. Who will pay for that cost?
amxexam
👍 1
Selected: B
Although we are talking about I year old data, we want to quickly aanalyze it. D is cost effective over B but D does not provide and analysis capability. B is google recomended hence willl go with B over D in this situation.
SamT1
👍 1
Selected: B
B is correct due to the frequency of audit and also B explains clearly explains the access control while D states delegate the access, which is very broad.
Davidik79
👍 6
Selected: D
Analysis happens once a year and GCS is a cheaper solution in this regard. Moreover, in GCS you can create temporary signed URLs for auditors who do not have GCP users through which they can be authenticated and given access to a single bucket or object. https://cloud.google.com/storage/docs/access-control#signed_urls_query_string_authentication
anjuagrawal
👍 1
Selected: B
Should be B. D can be true but the question nowhere specifies cloud storage only. The question says IAM logs for any changes and not just for cloud storage. Suppose any IAM changes done on VM, will option D cover those changes? No.
burner_1984
👍 2
B since the question says "you want to streamline and expedite the analysis and audit process."
Kubernetes
👍 1
I agree your opinion
ehgm
👍 2
Selected: B
If we look at the cost and the access is not frequent, D is best (cloud store) But the question says: streamline and expedite the analysis and audit process. So BigQuery is best, we can use view, restrict access to some columns and use a tool like Datastudio to generate dashboards.
sjmsummer
👍 1
I select D.
Sekierer
👍 1
Selected: B
B seems best
ABO_Doma
👍 1
Selected: B
Both Cloud Storage and Big Query are supported as sink destinations. Since our requirement is "to streamline and expedite the analysis and audit process" we should prefer using BigQuery over Cloud Storage because retrieving and analyzing data in BigQuery is very convenient and fast compare to Cloud Storage. You can also restrict access by using BigQuery ACLs and views. BigQuery Table ACL lets you set table-level permissions. Table-level permissions determine the users, groups, and service accounts that can access a table or view. You can give the user access to specific tables or views without giving the user access to the complete dataset. For example, grant the role BigQuery Data Viewer (roles/bigquery.dataViewer) to let a user query the table or view without dataset access. Ref: https://cloud.google.com/bigquery/docs/table-access-controls-intro
phantomsg
👍 1
Selected: B
https://cloud.google.com/iam/docs/roles-audit-logging#scenario_external_auditors
americoleonardo
👍 1
Selected: B
https://cloud.google.com/iam/docs/roles-audit-logging#scenario_external_auditors
ggzzzzzzz
👍 1
Selected: B
"streamline and expedite" the analysis and audit process, Bigquery is the right answer
haroldbenites
👍 3
Ten visit of auditors are each 12 months . It’s not necessary store the data on bigquery for that time . Better is store over cloud storage and when is necessary doing analysis , then load into some database like , cloud sql or bigquery or another and do the analysis . Go for D.
duocnh
👍 1
Selected: B
vote B
cdcollector
👍 1
https://cloud.google.com/iam/docs/roles-audit-logging#scenario_external_auditors
Chintzz
👍 1
Selected: B
B. https://cloud.google.com/iam/docs/roles-audit-logging#scenario_external_auditors
nareshthumma
👍 1
Selected: B
b is true
The_Dave_Mty
👍 1
Although B seems to be the right answer, D is simpler. B implies creating queries in BigQuery and setting the permissions to the auditors group where D is just a sink that you can create to save logs into GCS and for get about it now every year just share the bucket with the auditors Sink Supported destinations You can use the Log Router to route certain logs to supported destinations in any Cloud project. Logging supports the following sink destinations: Cloud Storage: JSON files stored in Cloud Storage buckets; provides inexpensive, long-term storage. BigQuery: Tables created in BigQuery datasets; provides big data analysis capabilities. Pub/Sub: JSON-formatted messages delivered to Pub/Sub topics; supports third-party integrations, such as Splunk, with Logging. Cloud Logging: Log entries held in log buckets; provides storage in Cloud Logging with customizable retention periods.
exam_war
👍 1
B is the right answer
FERIN_02
👍 4
Option B will be costly to store logs in BQ, But fast and efficient for analysis. Option D will be economical, but auditor need to manually check logs, will take time. Coming back to question asking for "You want to streamline and expedite the analysis and audit process." The term expedite analysis pont to BQ. Hence I prefer option B.
unnikrisb
👍 1
I go for B based https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors Cloud Storage is the destination for long term storage of audit logs. ( mostly used for operationally monitoring) . Also the auditor is not authorized to view PII data in the Admin Activity logs. To comply with this requirement, a dashboard is available that provides access to the historic logs stored in BigQuery, and on request, to the Cloud Logging Admin Activity logs.
rottzy
👍 2
it's for Auditor ~ not analyst to investigate Cloud Storage should be good enough for Audit logs - where logs will be kept/archived = it will not be archived in BQ!
raj1984
👍 1
Correct answer is B, even though you can export logs to cloud storage , here the key is expedited analysis of 12 months data, so bigquery comes in handy.
Skghost
👍 1
B is correct because the log file can also be from previous day as well, so we can't use coldline storage. Bigquery would be the best options for storing and analysis.
sandipk91
👍 1
I vote for B
amxexam
👍 3
Let's go with option elimination A. Create custom Google Stackdriver alerts and send them to the auditor >> Unwantedly complicated process lets eliminate B. Enable Logging export to Google BigQuery and use ACLs and views to scope the data shared with the auditor >> Is recommended way by using sinks to store in bigquery but there is no analytics required although the logs will be less (as we are talking about only access management and policy changelog ) C. Use cloud functions to transfer log entries to Google Cloud SQL and use ACLs and views to limit an auditor's view >> Unwantedly complicated process lets eliminate D. Enable Google Cloud Storage (GCS) log export to audit logs into a GCS bucket and delegate access to the bucket >> This is a cost-effective way to storing and providing access. There is no analytics so let not bring in query charge BigQuery charge $0.02 / GB Were as the GCS will be 1.3$ /GB/month Long run B looks better than D, but will still look for a convincing argument on D.
Urban_Life
👍 1
will go with D. take my word
Urban_Life
👍 1
changing my mind. It'll be B
NapoleonBorntoparty
👍 1
https://cloud.google.com/architecture/framework/security-privacy-compliance?hl=en-us#recommendations
Bhardwajriddhi
👍 1
Why not D export to Cloud storage & then run query against ferdated tables in CS using bigquery?
aviratna
👍 7
D is correct because - Audit needs data only once a year so using BigQuery will be costly - Storing data Cloud Storage will be the right option - And once data is required by Auditor at the end of Year access to BigQuery can be given which has IAM rules configured and which can read data from data stored in Cloud Storage
Partha84
👍 1
The answer should be B. As per Google recommended practise, GCS bucket is good for long term retention of logs. But, if you need analysis using logs, BigQuery is better option.
ArthurL20
👍 4
I choose B. Although CGS is cheaper, the question is asking for a "Streamlined" process. Thus, you sending the logs to BigQuery will automate the whole procedure and wont require loading and reconfiguring the data OnDemand.
victory108
👍 2
B. Enable Logging export to Google BigQuery and use ACLs and views to scope the data shared with the auditor
un
👍 1
I think its B
triplicated_lines
👍 2
D is the answer because it is cheaper to store in GCS Archive. Also for those of you who are talking about streamlined queries with BQ (which I agree with), you can actually use BQ to query GCS data via the federated model. Ultimately, D is best IMHO.
getzsagar
👍 1
D is better, with Archive storage in GCS where retrieval can be of 365 days, this solution is not only cheaper but also meets regulatory requirements.
Ausias18
👍 1
Answer is D, the auditor comes every 12 months, there is no need to rush with BQ
BeCalm
👍 1
Logs on GCS can be directly analyzed from BQ right?
AndreUanKenobi
👍 1
The requirement is to expedite Analysis, therefore B is better - BigQuery provides analytics.
VivekMishraV
👍 1
Need to Expedite process... B is better option. D- Auditing by check cloud storage logs will be time consuming and manual process.
AmitAr
👍 3
Please check the keywords in question -- "streamline and expedite" -- Bigquery is suitable not storage bucket. so it should be (B)
bnlcnd
👍 2
There is another question asking about similiar thing. That question says 5 year retention. this Q says 12 month plus keywords "streamline and expedite". So, this answer should be B
RKS_2021
👍 1
B is correct
lynx256
👍 5
If D, when auditors visit you, one way or another you have to load the logs to BQ because analysys of what was changed in IAM policy coud be hard to do form raw logs (objects in GCS bucket). So option D is probably a bit cheaper than B but more effort is needed (which also generate costs).
lynx256
👍 2
I don't think so... IMO B is the best.
Kevinzhang
👍 2
I would go with B. Notice the difference between B and D are the analytic functions, which is included in answer B. Here is the Google link for the details: https://cloud.google.com/solutions/exporting-stackdriver-logging-for-security-and-access-analytics. Answer D can save data, however it doesn't support analytic options. More details of this option: https://cloud.google.com/solutions/exporting-stackdriver-logging-for-compliance-requirements
Chulbul_Pandey
👍 2
the keyword here is - "streamline and expedite the analysis" so using cloud storage will bring in the latency and cost implications so it has to be BigQuery. Ans is B
ybe_gcp_cert
👍 1
B or D. B seems the best practice in case of "A third-party auditor is granted access several times a year" D seems also legit, you have to store 1 year of log then give access to external auditors to query over it. if you use BQ, so you are going to pay for the queries. Why not give them access to a GCS bucket. Also, Auditors generally bring their own tools, and we are (and google in its best practices) assume that Auditors know how to use SQL, Excel for sure but not SQL... I find D more realistic. So D is the correct answer for me.
Hjameel
👍 2
Expedite Analysis = BigQurey , Streamine ACL and views to scope the data with audiors I will go with : B
AdityaGupta
👍 1
I will go with answer B, Enable Logging export to Google BigQuery and use ACLs and views to scope the data shared with the auditor. Key terms here are ACL and Delegate access to bucket.
LoganIsh
👍 1
Looks to me D is more relevant than B,
ohhumor
👍 2
Key words "streamline and expedite the analysis and audit process.", So D is better, straightforward
subhala
👍 1
Since it is the audit logs, D appears most relevant.
subhala
👍 2
After reviewing https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors, potentially correct answers are B or D. However streamlining, expediting is the key - BQ will appear better. so will choose B
VedaSW
👍 2
I go with B. D is correct answer IF, I can modify the question to includes Cloud Logging is in used, and the logs is stored in GCS. Here is what D exactly worded: "D. Enable Google Cloud Storage (GCS) log export to audit logs into a GCS bucket and delegate access to the bucket" It did not mention Cloud Logging was in used. So at the best interpretation and benefits of doubts, it is only sending the logs related to Cloud Storage itself, and did not address activities in IAM. (which fails the objective)
RKS_2021
👍 1
100% right.
AshokC
👍 2
B - to expedite the analysis and audit process
parag27
👍 1
The questions asks about streamlining and expediting the analysis and audit process. Big query makes more sense than GCS for expediting the process. Question does not ask about cost effectiveness of the solution. B looks a better solution.
peterbrv
👍 1
D is the correct answer. multiple sites have it too
wiqi
👍 1
I think D makes sense. As with D you can provide a signed url for the object.
alii
👍 4
don't change your view, D was right :)
BigB
👍 2
What I missed in all the comments is the fact that this data is accessed only once in 12 months, thus GCS with nearline storage is best suited from a cost perspective. Secondly GCS can be queried from BigQuery using federated search, thus correct answer is D.
Gobblegobble
👍 1
More accurate answer will be GCS + Signed URLs
tartar
👍 14
Sorry, changed my view. B is the recommended practice
Alasmindas
👍 1
I will go with B. The questions says - You want to streamline and expedite the analysis and audit process. Which means there are two objectives for the auditors - a) They want to view the audit logs. b) They want to analyse the audit logs. Although option D looks a best choice for an auditor to view the audit logs, but since we are assuming that there are some amount of analysis involved, hence option B stand out
NeilNalto
👍 2
Requirements are; "You want to streamline and expedite the analysis and audit process." D enables a dump of data into a bucket with no specific interegation tools for this data. B allows specific data / information to be mined effeciantly. B is the answer.
deaglee
👍 1
Scenario – Export for compliance requirements - Long retention period, compliance - GCS Scenario – Export for security and access analytics - security and access analysis - BigQuery Google both scenarios, correct answer in this case (analysis) is B.
AmazonAu
👍 1
B key words: streamline and expedite the analysis and audit process
RM07
👍 1
Will go with D as ACL is at bucket level not at big query
Gobblegobble
👍 1
D is right answer
cetanx
👍 4
I believe the key request here is "streamline and expedite". Exporting to GCS and loading them into BQ every 12 months doesn't sound like "expedite and streamline". Thefore I vote for "B". BQ has ACLs at table-level https://cloud.google.com/bigquery/docs/table-access-controls-faq
mlantonis
👍 2
Again a tricky question with BigQuery and GCS. BigQuery sounds as a best practice, but it is much more expensive than GCS. I honestly cannot decide between B and D. In the exam I would go with B.
mlantonis
👍 1
Now that I think it again. I never heard of ACLs on BigQuery. Probably D is the correct.
kaush
👍 1
As the B has use ACLs mentioned ,where as BQ use IAM to access control ,going with D ACL was used by BQ previously but not now ,if there is no mention of ACL B Should be the correct answer ,IF this is a question applicable to older GCP version still the correct answer to be B
kaush
👍 1
Although there is a scenario in google docs ,which uses a dashboard application and service account to access BQ stored audit logs ,there is no concept of ACL with BQ as stated in Answer B, Hence going with D
Pupina
👍 2
Agree with D
Tushant
👍 2
Agree with D
iamgcp
👍 1
I think D is the correct answer. Export the logs to Google Cloud Storage bucket - Archive Storage, as it will not be used for 1 year, price for which is $0.004 per GB per Month. The price for long term storage in BigQuery is $0.01 per GB per Month (250% more). Also for analysis purpose, whenever Auditors are there(once per year), you can use BigQuery and use GCS bucket as external data source. BigQuery supports querying Cloud Storage data from these storage classes: Standard Nearline Coldline Archive
Sundeepk
👍 1
option B: because in terms of cost ... the cost is reduced by 50% if the data is not accessed or changed for 90 days ... BQ provides analytics capability .. The dataset can be made accessible to the auditors. Reference Link: https://cloud.google.com/bigquery/pricing
bubai01
👍 2
Ans: B Between B and D the only difference is the storage cost . In BigQuery for LongTerm storage the price is low as compared to CS.
olg
👍 1
1 cent per gb
Anilku
👍 1
B should be correct one.
olg
👍 1
analysis pointing us to Big Query
Nirms
👍 1
B is the correct answer
nrajesh
👍 1
B is answer. In bigquery you can use share dataset with permissions/view.
misho
👍 1
https://cloud.google.com/solutions/exporting-stackdriver-logging-for-compliance-requirements
nrajesh
👍 1
Thinking about D, but I could not find GCS log export option. Stackdriver does have export option but that is not a choice. For Bigquery sharing dataset has following option .... To grant access to this dataset, add members and assign Identity and Access Management (IAM) roles to specify their level of access. Multiple roles allowed. You can no longer set ACLs in the console to manage access.
misho
👍 2
You cannot use ACLs with BigQuery, so D is the answer. Also D is good because data will be viewed only once a year (could be stored in Coldline bucket). And if needed you can import it in BigQuery any time it's needed.
Ziegler
👍 1
B is correct
Ziegler
👍 1
I agree that D is the right answer due to storage cost and GCP best practices. Please ignore my previous answer
AD2AD4
👍 1
Final Decision to go with Option D
asure
👍 7
Your super power is to take "Final Decision"
jamjam2020
👍 2
expedite the analysis and audit process hence bigquery
huangmeiguai
👍 2
I choose B. keywords: "analysis and auditing" process. This means querying capabilities, hence BigQuery.
laksg
👍 1
Agree with D.
AmitAr
👍 4
data is 12 month old, we need not to preserve for 12 months, so cloud storage is not good option. This is required for - Streamline and expedite the analysis, Answer should be (B)
Rajuuu
👍 2
B IS correct
skywalker
👍 2
B sounds good but it's too expensive using BigQuery.. Thus I think D make a better choice.
skywalker
👍 2
Vote for B.... coz Best practices for auditor to review logs is via BIgQuery: https://cloud.google.com/blog/products/gcp/best-practices-for-working-with-google-cloud-audit-logging
gcp_aws
👍 1
I will go with D.
clouddude
👍 2
I will go with B as it takes advantage of BigQuery for analysis while using views to restrict the auditor's access.
skywalker
👍 1
B sounds better
BeppeIta
👍 2
Access Control for a BigQuery Dataset. BigQuery uses ACLs to manage permissions on datasets. ACLs are not directly supported on tables. A table inherits its ACL from the dataset that contains
Applehph
👍 6
B is better with better visibility for auditors . Scenario: External auditors In this scenario, audit logs for an organization are aggregated and exported to a central sink location. A third-party auditor is granted access several times a year to review the organization's audit logs. The auditor is not authorized to view PII data in the Admin Activity logs. To comply with this requirement, a dashboard is available that provides access to the historic logs stored in BigQuery, and on request, to the Cloud Logging Admin Activity logs. The organization creates a temporary auditor account for each audit period. This account is monitored and is typically granted access to the dashboard application. During normal access, the auditors are only granted access to view the historic logs stored in BigQuery. If any anomalies are discovered, the auditor is granted permission to view the actual Cloud Logging Admin Activity logs via the dashboard's elevated access mode. At the end of each audit period, access is then revoked. Data is redacted using Cloud DLP before being made accessible for viewing via the dashboard application.
aadaisme
👍 3
Maybe D is answer? Should ACL be used with GCS other than BQ? An access control list (ACL) is a mechanism you can use to define who has access to your buckets and objects, as well as what level of access they have. In Cloud Storage, you apply ACLs to individual buckets and objects.
bnlcnd
👍 1
https://cloud.google.com/bigquery/docs/table-access-controls-intro#permissions BQ can work with ACL.
Kite
👍 1
I am also thinking the same. ACLs are not for BQ, so it must be D.
2g
👍 2
answer: B
natpilot
👍 2
B is better
sri007
👍 2
B is the answer as i have collected it from 3 different test sets . B is Correct
ghitesh
👍 100
B. https://cloud.google.com/iam/docs/roles-audit-logging#scenario_external_auditors
AzureDP900
👍 1
B is correct
TheCloudBoy77
👍 4
B makes more sense after reading it. thx
MikeB19
👍 1
The article references either gcs or bq. I think this q is referring to gcs
aselunar
👍 8
In that scenario the audits were quarterly. For annual audits, Google recommends Cloud Storage.
anton_royce
👍 5
I agree. Answer B
rockstar9622
👍 3
b) seems correct
addy007
👍 5
it's A. https://cloud.google.com/blog/products/gcp/best-practices-for-working-with-google-cloud-audit-logging
deaglee
👍 1
Cloud Audit logs is different than Stackdriver alerts.
AWS56
👍 2
Agree with A
Shariq
👍 2
Admin Activity logs can be retained for 13 months without any charges. Why need to store it.. So I guess A is correct?
KouShikyou
👍 3
I think A is correct.
znd
👍 3
You should not send that data to any external team of your company
Smart
👍 3
Also, Alerts will be triggered on new data; not the existing data?
exampanic
👍 3
I believe A is incorrect. Enabling Stackdriver alerts is not the same thing as Stackdriver logging. Sending alerts to the auditors is not sending them the audit logs.
passnow
👍 1
You are correct because all other options would incur cost. Admin activity logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. Admin activity logs are always enabled. There's no charge for admin activity audit logs, and they're retained for 13 months/400 days.
Eroc
👍 9
A would prevent the annual audits, the audits would be on-going so it is incorrect. C is too expensive. This leaves B and D, BigQuery has an SQL interface which is popular among-st Business Analysts and D also just creates a dump file which is more difficult to read. However, B is more expensive than D. Audit can get expensive anyways, and the auditors look at the content not the view of the page. So D is a better choice than B.
mpguard
👍 14
Your objective is streamline and expedite. Not cost reduction. So B
jcmoranp
👍 38
Think B is better. Export to Bigquery and restrict access to queries with ACLs to auditors
nitinz
👍 3
D, rest all options are no good.
trainor
👍 4
I think D is better. B implies too much data manipulation to make it suitable for an audit.
tartar
👍 7
D is ok.
passnow
👍 5
I thought same as well. I would go with B
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option B is the correct answer because it aligns with Google's recommended architecture for external auditor access scenarios. By enabling Logging export to BigQuery, you create a centralized, structured dataset of all audit logs. This allows auditors to use standard SQL queries to filter specific IAM policy changes across the entire 12-month period instantly. Using ACLs and views ensures that only relevant data is exposed, maintaining security while providing the flexibility needed for efficient analysis.Why the Other Options Are Wrong
Option A is incorrect because Stackdriver (now Cloud Monitoring) alerts are designed for real-time notifications on specific conditions, not for storing historical log data for retrospective auditing. Option C involves Cloud SQL, which adds unnecessary operational overhead and cost for a read-heavy analytical workload that is better suited for BigQuery. Option D (GCS) is a valid retention strategy but fails the 'expedite' requirement; downloading and parsing raw JSON/text logs from GCS buckets is time-consuming and prone to error compared to querying a BigQuery table.Community Comment Notes
The community discussion highlights a tension between cost optimization and operational efficiency. While one commenter noted that "Audit can get expensive anyways," the prevailing consensus among high-voted comments supports BigQuery for its analytical power. One user pointed out that "BigQuery has an SQL interface which is popular among Business Analysts," emphasizing usability. Another commenter correctly identified that "Your objective is streamline and expedite. Not cost reduction," reinforcing why the cheaper GCS option is a distractor in this specific context.Official Reference
Exam Strategy
When a question asks to 'streamline', 'expedite', or 'analyze' large volumes of log data, prioritize managed analytics services like BigQuery over simple storage buckets. Always check if the primary constraint is speed/usability versus strict cost minimization; if analysis efficiency is highlighted, choose the queryable solution.
Frequently Asked Questions
Why not use Cloud Storage for audit logs?
While GCS is cheaper, it stores logs as flat files. Analyzing them requires custom scripts or manual inspection, which is slower and less scalable than using BigQuery's SQL interface for instant filtering.
Does exporting to BigQuery incur extra costs?
Yes, there are storage and query costs associated with BigQuery. However, for organizations requiring frequent or detailed audits, the operational efficiency and reduced labor time often justify the expense.
Related Analysis
Practice All PCA Questions
Access 81 questions with complete answers and detailed explanations.
View Full PCA Practice Test →