Google Associate Cloud Engineer Question 230
Select 2Google Cloud PlatformYou are a Cloud Engineer tasked with securing sensitive images stored in a Cloud Storage bucket. Your organization requires that these images are encrypted using a customer-managed encryption key (CMEK) and that unauthorized users cannot view or download these images. What steps should you take to meet these requirements?
- A
- Enable the 'Uniform bucket-level access' feature for the bucket.
- B
- Configure the bucket to use a customer-managed encryption key (CMEK).
- C
- Set an IAM policy to grant 'Storage Object Viewer' role to all internal users.
- D
- Enable Object Versioning to keep track of changes to the images.
- E
- Use Bucket Policy Only to restrict access to the images.
Show answer and explanation
Correct answers: A, B
Explanation
To secure sensitive images in a Cloud Storage bucket, enabling 'Uniform bucket-level access' simplifies permission management by applying access controls at the bucket level. Configuring the bucket to use a customer-managed encryption key (CMEK) ensures that the data is encrypted with a key that you control, providing a higher level of security. These steps align with the organization's requirements to secure and encrypt the images effectively.
- A. Correct.
Enabling 'Uniform bucket-level access' allows you to control access uniformly at the bucket level, making it easier to manage permissions and ensure unauthorized users don't have access.
- B. Correct.
Configuring the bucket to use a CMEK ensures that the sensitive images are encrypted with a key that your organization manages, providing you with control over the encryption process.
- C. Incorrect.
Granting 'Storage Object Viewer' to all internal users would allow broad access, which is against the requirement to prevent unauthorized users from viewing or downloading the images.
- D. Incorrect.
Object Versioning is useful for tracking changes, but it does not inherently provide security or encryption.
- E. Incorrect.
Bucket Policy Only (now known as 'Uniform bucket-level access') is indeed useful for access control, but it is not a step separate from option 1.