Google Cloud Professional Cloud Security Engineer Practice Exam

Which logs should a database administrator review to monitor malicious activities in a Cloud SQL instance?

1. System Logs

2. Data Access Logs

3. Audit Logs

4. Activity Logs

The correct answer is: Data Access Logs

A database administrator should focus on Data Access Logs to effectively monitor malicious activities in a Cloud SQL instance. These logs are designed to capture information on database access events, including successful and failed attempts to query the database. By analyzing the Data Access Logs, an administrator can identify unusual access patterns, such as repeated failed login attempts or unexpected queries, which may indicate unauthorized access or other malicious activities. While other logs serve important purposes, they do not specifically target the monitoring of access to database data. System Logs typically contain information about the operational status and performance of the database system, rather than detailed access events. Audit Logs, on the other hand, provide insights into administrative actions or changes to the configuration and security settings within Cloud SQL but may not directly record every data access event. Activity Logs generally capture a high-level overview of the actions taken within the Google Cloud environment but do not provide the granularity needed to monitor specific database access attempts. By leveraging Data Access Logs, a database administrator can better secure the Cloud SQL instance and respond to potential threats by identifying and addressing any suspicious activities promptly.