You have sensitive data stored in three Cloud Storage buckets and have enabled data access logging. You want to verify activities for a particular user for these buckets, using the fewest possible steps. You need to verify the addition of metadata labels and which files have been viewed from those buckets. What should you do?

The question requires viewing Data Access audit logs for specific user actions (viewing files, adding metadata) on Cloud Storage buckets. When Data Access logging is enabled for a service like Cloud Storage, these logs are sent to Cloud Logging (the service formerly known as Stackdriver Logging). The Logs Explorer within the Google Cloud Console is the primary and most powerful tool for querying these logs. It allows for precise filtering by principal (the user), resource name (the specific buckets), and the method name corresponding to the actions, thus fulfilling the requirements in the fewest steps.

A. The Activity page in the Google Cloud Console primarily shows Admin Activity and System Event audit logs. It does not typically display the high-volume Data Access logs required to see file views.
C. The Cloud Storage section of the console displays the current state of buckets and objects. It does not provide a historical audit trail of user access or specific metadata changes over time.
D. Cloud Trace (formerly Stackdriver Trace) is a distributed tracing system used for application performance monitoring and latency analysis, not for auditing user access to data.

1. Google Cloud Documentation

"Cloud Audit Logs overview": This document distinguishes between different types of audit logs. It clarifies that actions like reading data or metadata are captured in Data Access audit logs. It states

"Data Access audit logs are sent to Cloud Logging".

Source: Google Cloud Documentation > Cloud Audit Logs > Overview > Types of audit logs.

2. Google Cloud Documentation

"View logs in the Logs Explorer": This guide demonstrates how to use the Logs Explorer to build queries for filtering logs. You can filter by principalEmail for the user and resource.name for the Cloud Storage buckets

which directly supports the chosen answer.

Source: Google Cloud Documentation > Cloud Logging > Logs Explorer > View logs in the Logs Explorer.

3. Google Cloud Documentation

"Data access audit logs": This page details which services generate Data Access audit logs and confirms that for Cloud Storage

operations like storage.objects.get (viewing a file) are logged. It also confirms these logs are disabled by default and must be explicitly enabled

as stated in the question.

Source: Google Cloud Documentation > Cloud Audit Logs > Audit logging for Google Cloud services > Data access audit logs.

4. Google Cloud Documentation

"View the activity feed": This official source explicitly states what the Activity page contains: "The activity feed displays entries from your project's Admin Activity audit logs

System Event audit logs

and Access Transparency logs." This confirms that Data Access logs are not part of this view

making option A incorrect.

Source: Google Cloud Documentation > Getting Started > View the activity feed.