GCP ACE Practice / Study guide / Topics / Cloud Monitoring, Logging & Audit Logs

Cloud Monitoring, Logging & Audit Logs

What actually gets tested on the Google Cloud Associate Cloud Engineer exam, the traps to know, and 6 free sample questions with full explanations.

An alerting policy evaluates a metric condition over a duration and fires to a notification channel — but it only reaches a human if a channel (email, SMS, Pub/Sub) is actually attached. Dashboards visualize metrics but don't page anyone; log sinks archive logs but don't alert; budgets are a completely separate system. A frequent exam trap: an alerting policy exists and looks correctly configured, but there's no notification channel attached, so it fires silently and nobody finds out.

On what's actually visible: the hypervisor can see CPU and network externally without any extra setup, but it can't see inside the guest — memory percentage, disk usage, swap, and application-level metrics all require installing the Ops Agent on the instance. This is a recurring "why don't I see this metric" scenario. For events that aren't a built-in metric at all, a log-based metric turns a pattern in your logs into something you can alert on the same way.

Logs Explorer's query language filters by resource, severity, label, text, and time — a container's own filesystem is ephemeral and not a substitute for centralized logging. Log sinks route logs at ingestion time to GCS/BigQuery/Pub/Sub or another log bucket for long-term retention (Logging's own default buckets keep most logs for roughly 30 days). For audit logs specifically: Admin Activity logs are always on and cannot be disabled; Data Access logs (except for BigQuery, which is always on) are off by default and have to be enabled deliberately — a distinction the exam tests directly.

Exam tips for this topic

Sample questions — Cloud Monitoring, Logging & Audit Logs

These 6 questions are drawn from our full bank of 658 to show the style and depth you'll get in the app. Each comes with the full explanation you'd see after answering in a real practice session.

Audit logs

Which audit log type is ALWAYS on and cannot be disabled?

Why: Admin Activity (and System Event) audit logs are always written, free, and undisable-able. Data Access logs are mostly opt-in (BigQuery being a notable always-on exception), and flow/agent logs are features you enable.
Logging

Which query interface finds all ERROR-severity logs from one Cloud Run service in the last hour?

Why: Logs Explorer's query language filters by resource, severity, labels, text, and time. Container filesystems are ephemeral and not centralized.
Monitoring

You must be paged when the checkout API's error rate exceeds 2% for 5 minutes. Which Cloud Monitoring construct?

Why: Alerting policies evaluate metric conditions over durations and fire to notification channels. Dashboards visualize but don't page; sinks archive logs; budgets watch spend.
Audit logs

Security asks 'who read objects in this sensitive bucket last week?' What must have been enabled BEFOREHAND for the answer to exist?

Why: Object reads are data access, logged only if Data Access audit logging was enabled for the service (with volume/cost implications). Admin Activity covers configuration changes, not reads.
Logging

Compliance requires keeping ALL audit logs for 7 years cheaply. Default retention won't do. What do you configure?

Why: Sinks route logs at ingestion to GCS/BigQuery/Pub/Sub or other log buckets; long retention lives there (Logging's default buckets keep most logs ~30 days, admin audit 400 days). Exporting to Archive-class storage is the classic cheap 7-year answer.
Monitoring

Default Compute Engine metrics WITHOUT any agent include CPU and network — but which common metrics require installing the Ops Agent?

Why: The hypervisor can't see inside the guest: memory %, disk %, swap, and application metrics need the Ops Agent. CPU/network are visible externally and always available.

Practice this for real

The app has dozens more questions on this and every other topic, with instant scoring, spaced repetition of what you get wrong, and progress tracking across sessions.

Start practicing →

This topic shows up in

Domain 4Ensuring Successful Operation Domain 5Configuring Access and Security

Other topics

TopicIAM Roles & Permissions TopicService Accounts & Identity TopicBilling, Pricing & Cost Management TopicGoogle Kubernetes Engine (GKE) Topicgcloud CLI Commands TopicChoosing the Right Compute Option TopicCompute Engine Deployment & Operations TopicVPC Networking & Load Balancing TopicChoosing a Database on Google Cloud TopicResource Hierarchy, Projects & APIs TopicCloud Storage: Classes, Access & Security TopicServerless Compute: Cloud Run & App Engine TopicData Protection: Encryption & Secret Manager TopicInfrastructure as Code & Cloud Shell