Streamlining Cloud IAM Audit Analysis with BigQuery

PCA By islever Editorial Last updated

Designing for security.

Short answer

B Enable Logging export to Google BigQuery and use ACLs and views to scope the data shared with the auditor.

Question

Auditors visit your teams every 12 months and ask to review all the Google Cloud Identity and Access Management (Cloud IAM) policy changes in the previous 12
months. You want to streamline and expedite the analysis and audit process.
What should you do?
  1. Create custom Google Stackdriver alerts and send them to the auditor
  2. Enable Logging export to Google BigQuery and use ACLs and views to scope the data shared with the auditor Correct Answer
  3. Use cloud functions to transfer log entries to Google Cloud SQL and use ACLs and views to limit an auditorג€™s view
  4. Enable Google Cloud Storage (GCS) log export to audit logs into a GCS bucket and delegate access to the bucket

Key Takeaways

The core concept is secure log analysis; the common trap is choosing cheaper storage (GCS) over a query engine (BigQuery) when the requirement explicitly emphasizes streamlining and expediting the analysis process rather than just minimizing cost.

This question addresses the best practice for exporting and analyzing Google Cloud IAM audit logs to streamline annual audits. The correct approach leverages Google BigQuery for its powerful SQL querying capabilities, allowing auditors to efficiently analyze policy changes without managing raw log files.

Common mistake: Many learners select Option D (GCS export) because it is cheaper and suitable for long-term retention. However, GCS stores logs as unstructured text files, making manual or script-based analysis significantly slower and more complex compared to the structured SQL queries available in BigQuery, which directly contradicts the goal of 'expediting' the review.

Expert Analysis

Why the Answer Is Correct

Option B is the correct answer because it aligns with Google's recommended architecture for external auditor access scenarios. By enabling Logging export to BigQuery, you create a centralized, structured dataset of all audit logs. This allows auditors to use standard SQL queries to filter specific IAM policy changes across the entire 12-month period instantly. Using ACLs and views ensures that only relevant data is exposed, maintaining security while providing the flexibility needed for efficient analysis.

Why the Other Options Are Wrong

Option A is incorrect because Stackdriver (now Cloud Monitoring) alerts are designed for real-time notifications on specific conditions, not for storing historical log data for retrospective auditing. Option C involves Cloud SQL, which adds unnecessary operational overhead and cost for a read-heavy analytical workload that is better suited for BigQuery. Option D (GCS) is a valid retention strategy but fails the 'expedite' requirement; downloading and parsing raw JSON/text logs from GCS buckets is time-consuming and prone to error compared to querying a BigQuery table.

Community Comment Notes

The community discussion highlights a tension between cost optimization and operational efficiency. While one commenter noted that "Audit can get expensive anyways," the prevailing consensus among high-voted comments supports BigQuery for its analytical power. One user pointed out that "BigQuery has an SQL interface which is popular among Business Analysts," emphasizing usability. Another commenter correctly identified that "Your objective is streamline and expedite. Not cost reduction," reinforcing why the cheaper GCS option is a distractor in this specific context.

Official Reference

https://cloud.google.com/iam/docs/roles-audit-logging#scenario_external_auditors

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question asks to 'streamline', 'expedite', or 'analyze' large volumes of log data, prioritize managed analytics services like BigQuery over simple storage buckets. Always check if the primary constraint is speed/usability versus strict cost minimization; if analysis efficiency is highlighted, choose the queryable solution.

Frequently Asked Questions

Why not use Cloud Storage for audit logs?

While GCS is cheaper, it stores logs as flat files. Analyzing them requires custom scripts or manual inspection, which is slower and less scalable than using BigQuery's SQL interface for instant filtering.

Does exporting to BigQuery incur extra costs?

Yes, there are storage and query costs associated with BigQuery. However, for organizations requiring frequent or detailed audits, the operational efficiency and reduced labor time often justify the expense.

More PCA FAQ →

Discussion 181 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 181

  1. jcmoranp 👍 38
    Think B is better. Export to Bigquery and restrict access to queries with ACLs to auditors
  2. mpguard 👍 14
    Your objective is streamline and expedite. Not cost reduction. So B
  3. tartar 👍 14
    Sorry, changed my view. B is the recommended practice
  4. Eroc 👍 9
    A would prevent the annual audits, the audits would be on-going so it is incorrect. C is too expensive. This leaves B and D, BigQuery has an SQL interface which is popular among-st Business Analysts and D also just creates a dump file which is more difficult to read. However, B is more expensive than D. Audit can get expensive anyways, and the auditors look at the content not the view of the page. So D is a better choice than B.
  5. aselunar 👍 8
    In that scenario the audits were quarterly. For annual audits, Google recommends Cloud Storage.
Show 25 more comments
  1. aviratna 👍 7
    D is correct because - Audit needs data only once a year so using BigQuery will be costly - Storing data Cloud Storage will be the right option - And once data is required by Auditor at the end of Year access to BigQuery can be given which has IAM rules configured and which can read data from data stored in Cloud Storage
  2. asure 👍 7
    Your super power is to take "Final Decision"
  3. tartar 👍 7
    D is ok.
  4. Applehph 👍 6
    B is better with better visibility for auditors . Scenario: External auditors In this scenario, audit logs for an organization are aggregated and exported to a central sink location. A third-party auditor is granted access several times a year to review the organization's audit logs. The auditor is not authorized to view PII data in the Admin Activity logs. To comply with this requirement, a dashboard is available that provides access to the historic logs stored in BigQuery, and on request, to the Cloud Logging Admin Activity logs. The organization creates a temporary auditor account for each audit period. This account is monitored and is typically granted access to the dashboard application. During normal access, the auditors are only granted access to view the historic logs stored in BigQuery. If any anomalies are discovered, the auditor is granted permission to view the actual Cloud Logging Admin Activity logs via the dashboard's elevated access mode. At the end of each audit period, access is then revoked. Data is redacted using Cloud DLP before being made accessible for viewing via the dashboard application.
  5. Davidik79 👍 6 Answered D
    Analysis happens once a year and GCS is a cheaper solution in this regard. Moreover, in GCS you can create temporary signed URLs for auditors who do not have GCP users through which they can be authenticated and given access to a single bucket or object. https://cloud.google.com/storage/docs/access-control#signed_urls_query_string_authentication
  6. lynx256 👍 5
    If D, when auditors visit you, one way or another you have to load the logs to BQ because analysys of what was changed in IAM policy coud be hard to do form raw logs (objects in GCS bucket). So option D is probably a bit cheaper than B but more effort is needed (which also generate costs).
  7. Sukhi4fornet 👍 5
    D is the correct answer as it is cost effective B is correct if frequency is more like several times a year which is mentioned in below mentioned link https://cloud.google.com/iam/docs/roles-audit-logging#scenario_external_auditors
  8. addy007 👍 5
    it's A. https://cloud.google.com/blog/products/gcp/best-practices-for-working-with-google-cloud-audit-logging
  9. passnow 👍 5
    I thought same as well. I would go with B
  10. anton_royce 👍 5
    I agree. Answer B
  11. Ekramy_Elnaggar 👍 4 Answered B
    1. Comprehensive Audit Trail: Cloud Logging automatically captures audit logs for all Cloud IAM activity. Exporting these logs to BigQuery provides a centralized and comprehensive audit trail for analysis. 2. Powerful Analysis: BigQuery's analytical capabilities allow auditors to efficiently query and analyze IAM policy changes over the 12-month period. They can filter, aggregate, and generate reports to identify any anomalies or security concerns. 3. Granular Access Control: BigQuery's Access Control Lists (ACLs) and views enable you to precisely control which data the auditors can access. This ensures that they only see the information relevant to their audit without exposing sensitive data. Note: While exporting logs to Cloud Storage is possible, it's less efficient for analysis compared to BigQuery.
  12. ramjisriram 👍 4 Answered B
    Key clue from the question is "You want to streamline and expedite the analysis". How can you expect streamline and analysis capabilities from Cloud Storage? Rather BigQuery has the analytics and streamline capabilities inbuilt in the tool. User access can be controlled in both, so the correct answer with key clues is to Enable Logging export to Google BigQuery (this will store all the logs streamlined) and use ACLs (these are filters, so according to the audior) and views (these are read only, there is no obfuscation or tokenization or sensistive data to be handled from the logs !!!!) to scope the data shared with the auditor.
  13. FERIN_02 👍 4
    Option B will be costly to store logs in BQ, But fast and efficient for analysis. Option D will be economical, but auditor need to manually check logs, will take time. Coming back to question asking for "You want to streamline and expedite the analysis and audit process." The term expedite analysis pont to BQ. Hence I prefer option B.
  14. Teckexam 👍 4 Answered B
    Based on google documentation B is the correct answer. https://cloud.google.com/iam/docs/job-functions/auditing#scenario_external_auditors Dashboard is available in BigQuery to review historic logs and in case anamoly is found elevated access is provided. Access is revoked after audit activities are done.
  15. cetanx 👍 4
    I believe the key request here is "streamline and expedite". Exporting to GCS and loading them into BQ every 12 months doesn't sound like "expedite and streamline". Thefore I vote for "B". BQ has ACLs at table-level https://cloud.google.com/bigquery/docs/table-access-controls-faq
  16. preman 👍 4
    The question specifically mentions ' to expedite the Analysis and Auditing process' . Normally for storage scenarios option D with GCS would suffice---but in this scenario since we also need expedited analysis---the any solution involving BQ is preferred. Correct Answer - B.
  17. ArthurL20 👍 4
    I choose B. Although CGS is cheaper, the question is asking for a "Streamlined" process. Thus, you sending the logs to BigQuery will automate the whole procedure and wont require loading and reconfiguring the data OnDemand.
  18. midgoo 👍 4 Answered D
    D is good and cheap. If I am an external Auditor, I will love D. Just pass me the file, why force me to use GCP BigQuery? B would mean the Auditor must use BigQuery to query the data. Who will pay for that cost?
  19. AmitAr 👍 4
    data is 12 month old, we need not to preserve for 12 months, so cloud storage is not good option. This is required for - Streamline and expedite the analysis, Answer should be (B)
  20. H_S 👍 4 Answered D
    READ THIS, ACL is not available in BIG QUERY , thereforeD. Enable Google Cloud Storage (GCS) log export to audit logs into a GCS bucket and delegate access to the bucket
  21. Mahmoud_E 👍 4
    D for long term and just once a year audit, this post is for several audits a year https://cloud.google.com/iam/docs/roles-audit-logging#scenario_external_auditors
  22. trainor 👍 4
    I think D is better. B implies too much data manipulation to make it suitable for an audit.
  23. Prakzz 👍 4 Answered D
    B talks about ACL in BigQuery and ACL is not associated with BigQuery but with GCS.
  24. TheCloudBoy77 👍 4
    B makes more sense after reading it. thx
  25. alii 👍 4
    don't change your view, D was right :)

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Multi-Regional vs Regional Cloud Storage for Global Software Downloads

S-grade

Surviving a Zone Outage With SQL Server on GCP

S-grade

Fixing BigQuery connection errors from a Compute Engine VM

S-grade

Moving 75 TB into Cloud Storage with Google-recommended practices

S-grade

Practice All PCA Questions

Access 81 questions with complete answers and detailed explanations.

View Full PCA Practice Test →

← Back to PCA Study Guide