Exam Security-Operations-Engineer Topic 1 Question 39 Discussion

Comprehensive and Detailed 150 to 250 words of Explanation From Exact Extract Google Security Operations Engineer documents:
This question is a balance between enabling detection and managing cost. Event Threat Detection (ETD) identifies threats by analyzing logs, and the specific detection for data exfiltration requires Data Access audit logs.
Data Access audit logs are disabled by default because they are high-volume and can be expensive. The key requirement is to "minimize Cloud Logging costs" while still enabling the detection for specific sensitive resources.
Data exfiltration is a "data read" operation. Therefore, to meet the requirements, the organization only needs to enable "data read" audit logs. Enabling "data write" logs (Option B) is unnecessary for this detection and would add needless cost. Enabling logs for all resources (Option C) would be prohibitively expensive and violates the "minimize cost" constraint. While ETD does use VPC Flow Logs (Option D) for many network- based detections, they do not provide the resource-level detail (i.e., which bucket or dataset was accessed) required for this specific data exfiltration finding. Therefore, enabling "data read" logs only for the sensitive resources is the most precise, cost-effective solution.
(Reference: Google Cloud documentation, "Event Threat Detection overview"; "Enable Event Threat Detection"; "Cloud Logging - Data Access audit logs")