Google Professional Cloud Developer Question 161
Single answerGoogle Cloud PlatformYou are developing an application that serves media files from Google Cloud Storage. For security reasons, you need to provide time-limited access to specific objects in the bucket. Which approach should you use to accomplish this?
- A
Create a signed URL for the object with an expiration time.
- B
Set fine-grained IAM permissions for the object with a time condition.
- C
Use the default public URL of the object and delete the object after the required time has passed.
- D
Enable Object Lifecycle Management to make the object inaccessible after a specific time.
Show answer and explanation
Correct answer: A
Explanation
The correct approach to provide time-limited access to objects in Google Cloud Storage is to use signed URLs. These URLs are cryptographically signed and include an expiration time, allowing temporary access without exposing the object publicly or requiring additional IAM configuration.
- A. Correct.
Correct. Signed URLs allow you to securely grant time-limited access to specific objects in Google Cloud Storage. You can specify an expiration time to ensure access is revoked after the limit.
- B. Incorrect.
Incorrect. While IAM permissions can control access to objects, they cannot provide granular time-limited access using a time condition. Signed URLs are more appropriate for this use case.
- C. Incorrect.
Incorrect. Using the default public URL exposes the object to anyone with the link. Additionally, manually deleting the object introduces operational complexity and is not a secure or scalable approach.
- D. Incorrect.
Incorrect. Object Lifecycle Management is used to manage the lifecycle of objects, such as deleting or transitioning them to different storage classes, but it does not provide secure, time-limited access for specific users.