Your auditor wants to view your organization's use of data in Google Cloud. The auditor is most interested in auditing who accessed data in Cloud Storage buckets. You need to help the auditor access the data they need. What should you do?

To audit who accessed data within Cloud Storage buckets, you must use Data Access audit logs. Unlike Admin Activity logs, which track administrative changes, Data Access logs record API calls that read, create, or modify user-provided data. These logs are disabled by default for Cloud Storage due to their potential volume and must be explicitly enabled for the specific buckets the auditor needs to review. Once enabled, the Logs Explorer (formerly Log Viewer) in Cloud Logging is the appropriate tool to build queries that filter for Cloud Storage access events, providing the auditor with the required information.

A. Cloud Monitoring provides performance metrics and infrastructure health data (e.g., object count, latency), not detailed audit trails of individual user access to data.
B. Admin Activity Audit Logs record administrative actions, such as creating a bucket or changing IAM policies, not who read or wrote data within the bucket.
D. This option is incorrect because it relies on Admin Activity Audit Logs, which do not contain the necessary data access information the auditor requires.

1. Google Cloud Documentation - Cloud Audit Logs with Cloud Storage: "Data Access audit logs contain API calls that read the configuration or metadata of resources

as well as user-driven API calls that create

modify

or read user-provided resource data... Data Access audit logs are disabled by default..." This source confirms that Data Access logs are required for this task and are disabled by default.

Source: Google Cloud Documentation

"Using Cloud Audit Logs with Cloud Storage"

Section: "Audit log types".

2. Google Cloud Documentation - Configuring Data Access audit logs: "By default

audit logs for most Google Cloud services are disabled... To receive Data Access audit logs

you must explicitly enable them." This document outlines the procedure for enabling these logs

which is the first step required in the correct answer.

Source: Google Cloud Documentation

"Configuring Data Access audit logs"

Section: "Overview of Data Access audit log configuration".

3. Google Cloud Documentation - View logs by using the Logs Explorer: "The Logs Explorer lets you retrieve

view

and analyze log data from your Google Cloud projects." This confirms that the Logs Explorer (Log Viewer) is the correct tool for querying the enabled logs.

Source: Google Cloud Documentation

"View logs by using the Logs Explorer"

Section: "Logs Explorer interface".