During a monthly security review, you need to determine who can view data in a Google Cloud project. What should you do?

To determine who can view data, you must review Identity and Access Management (IAM) permissions. IAM defines who has what access to which resources. By examining the IAM policies for your project and specific data resources, you can see which users or service accounts have roles that include data viewing privileges (e.g., roles/viewer, roles/storage.objectViewer). Enabling Audit Logs would show who accessed data in the past, not who can access it currently. Identity-Aware Proxy (IAP) controls access to applications and VMs, not directly to data stored in services like Cloud Storage or BigQuery. A Data Loss Prevention (DLP) job scans for sensitive data and helps prevent its exfiltration, but it doesn't show who has permission to view existing data.