nerdexam
Google

PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #11

Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was…

The correct answer is A. 1. Use StackDriver Logging and filter on BigQuery Insert Jobs. To validate that all data written to BigQuery was performed by the App Engine Default Service Account, use Cloud Logging to filter and review BigQuery insert jobs.

Submitted by renata2k· Apr 18, 2026Managing operations within a cloud solution environment

Question

Last week, a company deployed a new App Engine application that writes logs to BigQuery. No other workloads are running in the project. You need to validate that all data written to BigQuery was done using the App Engine Default Service Account. What should you do?

Options

  • A
    1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
  • B
    1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
  • C
    1. In BigQuery, select the related dataset.
  • D
    1. Go to the IAM section on the project.

How the community answered

(21 responses)
  • A
    81% (17)
  • B
    5% (1)
  • C
    5% (1)
  • D
    10% (2)

Why each option

To validate that all data written to BigQuery was performed by the App Engine Default Service Account, use Cloud Logging to filter and review BigQuery insert jobs.

A1. Use StackDriver Logging and filter on BigQuery Insert Jobs.Correct

Cloud Logging (formerly Stackdriver Logging) captures audit logs for BigQuery, which include details about who performed an operation, such as the principal (service account) responsible for BigQuery insert jobs, allowing validation of the default App Engine service account usage.

B1. Use StackDriver Logging and filter on BigQuery Insert Jobs.
C1. In BigQuery, select the related dataset.

Selecting a dataset in BigQuery allows viewing data or dataset metadata but does not provide audit logs about which service account performed insert operations.

D1. Go to the IAM section on the project.

The IAM section shows current permissions but does not provide historical audit trails or details about which service account executed specific BigQuery operations.

Concept tested: Auditing service account activity with Cloud Logging

Source: https://cloud.google.com/logging/docs/audit/bigquery-audit-log

Topics

#Cloud Logging#BigQuery#Service Accounts#Audit Logs

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice