An external identity with a highly privileged IAM role exists in a critical project. You need to determine whether actions were taken by this identity. Logs are centralized in Cloud Logging, and historical logs exported to BigQuery. What should you do?

• A. Execute queries against Cloud Logging and BigQuery datasets to filter logs where principal email matches the external identity.
• B. Analyze IAM recommender insights and SCC findings.
• C. Analyze VPC Flow Logs exported to BigQuery; correlate source IPs with potential login events.
• D. Use Policy Analyzer to identify accessible resources, then examine logs for those resources.

Answer: (A)

The key idea is to use the audit logs to establish what action, if any, the external identity performed. Cloud Logging contains Cloud Audit Logs that record administrative and data-access activities, including which identity (principalEmail) performed each operation and on which resource. Since historical logs are exported to BigQuery, you can run queries across both the real-time logs in Cloud Logging and the long-term data in BigQuery to find every event tied to that external identity. By filtering for the principalEmail that matches the external identity, you can enumerate all actions, drill into the resources involved, and note timestamps to determine what was done and when.

This approach directly answers the objective because it relies on the actual activity records, not on recommendations or policy views. Other options don’t capture exact actions by a user or service account: recommender insights and Security Command Center findings focus on potential issues or suggestions rather than concrete actions; VPC Flow Logs show network traffic, which may indicate activity but doesn’t prove which identity performed it; Policy Analyzer reveals what resources a principal could access, not what they actually did.