An investigator reviews a suspicious deletion of a Cloud Storage bucket and wants to know what a single administrative audit entry should reveal. Which details are typically present?
Show answer and explanation
Answer: D
An audit entry records the authenticated principal, the service and method invoked, the resource name, request and response metadata, and a timestamp. These fields together let an investigator reconstruct who deleted the bucket, when it happened, and through which API. That completeness is why audit logs are central to incident response and compliance reviews.
Why the other options are wrong
- A. Identity is a core part of the audit record, because attributing actions to a principal is the main purpose of the log.
- B. Error text is only one field. An entry also records who acted and what they targeted, so an error-only log would be incomplete for this investigation.
- C. Billing details are not part of audit entries. Cost data lives in billing exports and reports, not in these logs.