Objective 4.2

PCSE

Configuring logging, monitoring, and detection

Objective 4.2 sits in Managing operations, which carries 19% of the Cloud Security Engineer exam. The questions below are original, written from the official objective title above, and each explanation cites the Google Cloud page it rests on.

Objective title verbatim from the official objectives. Google Cloud exam page

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

4-2Managing operations

An investigator finds no record of who read objects in a Cloud Storage bucket last month. What is the likely explanation?

Storage writes those events only to usage logsUsage logs are a separate opt-in feature and not where this trail lives.
Data Access logs are off unless explicitly enabledCorrect · your answerCorrect. Nothing was recorded to age out.
The events aged out of the _Required bucketRetention would not explain an absence across a whole month of reads.
Reads are recorded as Admin Activity entriesReads land in a different class from configuration changes.

Correct.

Concept

A log that is on everywhere by default would cost more than most of what it records. The volume argument is why the highest-volume class starts off and has to be turned on where it is wanted.

Why B

Data Access audit logs are disabled by default for every service except BigQuery, and must be explicitly enabled for other Google Cloud services; they are written to the project whose data is accessed.

Source

Except for BigQuery, Data Access audit logs are disabled by default because they can generate large volumes of data. To record Data Access audit logs for Google Cloud services other than BigQuery, you must explicitly enable them. Data Access audit logs are written to the Google Cloud project whose data is accessed.

Google Cloud: Cloud Audit Logs overview, checked August 2026
#gcp#cloud-audit-logs#data-access#defaults

Now you: objective 4.2 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

4-2Managing operations

A team disables the Cloud Logging API in a project to cut costs. What happens to the Admin Activity audit logs there?

Sample question 2 of 3

4-2Managing operations

A VPC Service Controls rollout floods a project with Policy Denied entries and the team wants the storage cost gone. What can they do?

Sample question 3 of 3

4-2Managing operations

An auditor with the Logs Viewer role can see administrative changes but not Data Access entries in the _Default bucket. Which role closes that gap?

Full Cloud Security Engineer question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Managing operations