Generating Compliance Evidence Reports in GCP

PSOE Last updated Oct 24, 2026

Developing and implementing mechanisms to detect risks and identify threats. Developing and maintaining dashboards and reports to provide insights.

Short answer

A Run an audit using the compliance framework in Audit Manager and export the evaluation to provide evidence of non-compliant resources.

Question

Your company's risk management and compliance team requires regular reporting on compliance with industry standard control frameworks for a regulated business unit that continuously adds projects. You need to create a report that includes evidence of non-compliant resources found in this environment. How should you generate this report?

Run an audit using the compliance framework in Audit Manager. Export the evaluation for consumption by the second-line team. Correct Answer
Run queries for the required controls using the Cloud Asset Inventory data stored in BigQuery. Schedule this report to run regularly.
Implement the control framework using Rego, and deploy this framework in Workload Manager. Schedule a regular report in Workload Manager.
Implement the built-in posture for the compliance framework within the Security Command Center (SCC) posture.

Key Takeaways

The question tests the distinction between SCC posture management (misconfiguration detection) and Audit Manager (formal evidence collection and audit reporting); the requirement for evidence dictates Audit Manager.

Google Cloud Audit Manager is the designated service for running audits against industry standard compliance frameworks to collect evidence and generate reports. This page explains why Audit Manager is required over Security Command Center for formal compliance evidence reporting.

Common mistake: Choosing SCC (Option D) because it handles compliance postures, but SCC lacks the formal evidence collection and audit report generation capabilities required by risk and compliance teams.

Expert Analysis

Why the Answer Is Correct

Audit Manager is specifically designed to automate the collection of compliance evidence and generate audit reports against industry standard control frameworks. By running an audit and exporting the evaluation, the second-line risk management team receives the formal, evidence-backed reports they require for continuous compliance monitoring. This directly satisfies the requirement for regular reporting on compliance with evidence of non-compliant resources.

Why the Other Options Are Wrong

Option B uses Cloud Asset Inventory in BigQuery, which provides raw asset data but lacks the mapping to compliance frameworks and the formal evidence collection needed for an audit. Option C uses Workload Manager, which evaluates workloads against best practices using Rego but is not designed for comprehensive compliance framework auditing with evidence. Option D uses Security Command Center (SCC) posture management, which detects misconfigurations and provides dashboards but does not generate the formal audit reports with evidence required by compliance teams.

Community Comment Notes

Commenters highlighted the distinction between SCC and Audit Manager, noting that "SCC provides the data; Audit Manager provides the report," as medinaaa observed. Another user emphasized that the explicit requirement to "create a report that includes evidence" points directly to Audit Manager's core functionality of collecting evidence and generating audit reports. This distinction is crucial for choosing the right tool for second-line compliance teams.

Exam Strategy

When a question asks for evidence or formal audit reports for compliance frameworks, always select Audit Manager. SCC is for real-time threat and posture detection, while Audit Manager is for formal compliance assurance and evidence gathering.

Community Votes

77%

23%

77% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.

From public community threads 3

medinaaa 👍 2 Answered A

Implementing a posture in Security Command Center (SCC) enables the scanning and detection of misconfigurations (e.g., it turns on the detectors). However, the act of generating a formal "Audit Report with Evidence" is the specific domain of Audit Manager. SCC provides the data; Audit Manager provides the report.
TitanZauron 👍 1 Answered D

In Google Cloud, managing risk and compliance across a regulated business unit that continuously scales requires an automated, centralized, and policy-driven approach: 1. Security Command Center (SCC) Security Posture Management: Google Cloud SCC provides native Security Posture Management, which includes built-in posture templates aligned with major industry control frameworks (such as CIS Benchmarks, NIST SP 800-53, PCI DSS, ISO 27001, and SOC 2).
caitlynth 👍 1 Answered A

Question "requires regular reporting" "create a report that includes evidence" Audit Manager : Run Audit → Collect Evidence → Identify Violations → Generate Audit Report schedule audits to run at regular intervals(From doc)

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

← Back to PSOE Study Guide