Google
ASSOCIATE-CLOUD-ENGINEER · Question #162
An employee was terminated, but their access to Google Cloud Platform (GCP) was not removed until 2 weeks later. You need to find out this employee accessed any sensitive customer information after…
The correct answer is C. View Data Access audit logs in Stackdriver. Search for the user's email as the principal. We are trying to find out if any sensitive data was accessed. Data access logs are the only logs https://cloud.google.com/logging/docs/audit#data-access
Submitted by takeshi77· Mar 30, 2026Configuring access and security
Question
An employee was terminated, but their access to Google Cloud Platform (GCP) was not removed until 2 weeks later. You need to find out this employee accessed any sensitive customer information after their termination. What should you do?
Options
- AView System Event Logs in Stackdriver. Search for the user's email as the principal.
- BView System Event Logs in Stackdriver. Search for the service account associated with the user.
- CView Data Access audit logs in Stackdriver. Search for the user's email as the principal.
- DView the Admin Activity log in Stackdriver. Search for the service account associated with the
How the community answered
(15 responses)- B13% (2)
- C80% (12)
- D7% (1)
Explanation
We are trying to find out if any sensitive data was accessed. Data access logs are the only logs https://cloud.google.com/logging/docs/audit#data-access
Topics
#Data Access audit logs#Cloud Logging#security investigation#audit trails
Community Discussion
No community discussion yet for this question.