Google Associate Cloud Engineer Question 234
Select 2Google Cloud PlatformYou are managing a Google Cloud Storage bucket that contains sensitive financial data. To ensure data security, you want to enforce uniform bucket-level access to restrict public access and use a specific encryption key for all objects. What steps should you take to achieve this?
- A
A. Enable Uniform bucket-level access on the bucket.
- B
B. Use the default Google-managed encryption key for all objects.
- C
C. Configure a custom IAM policy to restrict public access.
- D
D. Use a Customer-Managed Encryption Key (CMEK) for the bucket.
- E
E. Enable Object Versioning to maintain data history.
Show answer and explanation
Correct answers: A, D
Explanation
To achieve the goal of securing sensitive data in a Cloud Storage bucket, enabling Uniform bucket-level access ensures that all objects adhere to the same access policies, thus preventing public access. Additionally, using a Customer-Managed Encryption Key (CMEK) provides control over the encryption process, enhancing the security of the data stored in the bucket.
- A. Correct.
Enabling Uniform bucket-level access will apply the same access policies to all objects, preventing public access.
- B. Incorrect.
The default Google-managed encryption key is used by default and does not provide the additional control of a Customer-Managed Encryption Key (CMEK).
- C. Incorrect.
While custom IAM policies can restrict access, Uniform bucket-level access is a more comprehensive and simpler solution for this scenario.
- D. Correct.
Using a Customer-Managed Encryption Key (CMEK) allows you to control the encryption keys used for your data, adding an extra layer of security.
- E. Incorrect.
Object Versioning helps in maintaining data history but does not directly enhance the security of the data.