Logs that record who did what, where, and when in Google Cloud. Admin Activity and System Event logs are always on and kept for 400 days in the _Required bucket; Data Access logs are off by default for most services.
The ACE asks where to find who changed an IAM policy (Admin Activity, SetIamPolicy method) and what to enable to know who reads data (Data Access).
Cloud Audit Logs is a concept that can show up on the exam. Check the full guide to see it in context.