Question

A compliance auditor asks your team to demonstrate which Cloud Audit Logs categories are always captured for a GCP organization without any administrator action to enable them, and which cannot be disabled. During a review, a security engineer claims that all audit log types must be explicitly enabled before they generate entries. Which statement correctly describes the default and configurability behavior of Cloud Audit Log types that you should document for the auditor?

Accepted Answer

Admin Activity and System Event logs are written by default and cannot be disabled, while Data Access logs (except BigQuery) are disabled by default and must be enabled.

Answer

All four audit log types (Admin Activity, System Event, Data Access, Policy Denied) are disabled by default and must be individually enabled in the organization's data access configuration.

Answer

Admin Activity logs are disabled by default but System Event and Data Access logs are always enabled and cannot be turned off.

Answer

Only Data Access logs are written by default; Admin Activity and System Event logs require enabling an audit configuration at the organization level.