An auditor needs a record of which user ran which SQL statement against BigQuery datasets across the organization, including the statement text. Which logging must be in place?
Show answer and explanation
Answer: B
BigQuery Data Access audit logs record data-plane activity, including job details such as the submitted query text, the calling principal, and the tables referenced. The relevant log types must be enabled in the audit configuration, at the organization level if the requirement spans every project, and the team should verify that setting rather than assume it. Admin Activity logs cover administrative changes like creating or deleting datasets, so they omit query content. Network logs and metrics describe traffic and performance, not which statement a user ran.
Why the other options are wrong
- A. Admin Activity logs are always written, but they record configuration changes such as dataset creation and deletion. Query statements are data-plane operations and do not appear there.
- C. VPC Flow Logs record IP-level network flows between endpoints. BigQuery statements are API calls, so flow records cannot show which SQL a user executed.
- D. Monitoring alerts on slot usage show capacity and load trends. They reveal activity levels but not the identity behind a statement or the statement's text.