Google Professional Cloud Developer Question 447
Single answerGoogle Cloud PlatformYou are developing a REST API using Google Cloud Functions to serve user data from Firestore. To comply with security best practices, you need to restrict the returned data to exclude sensitive fields like email and phone number when serving user details. Which of the following is the most appropriate way to achieve this?
- A
Use Firestore security rules to restrict access to sensitive fields.
- B
Filter out sensitive fields in your Cloud Function before returning the response.
- C
Enable fine-grained IAM roles to prevent access to sensitive fields.
- D
Use Firestore’s query projections to exclude sensitive fields.
Show answer and explanation
Correct answer: B
Explanation
The best way to restrict sensitive data in API responses is to handle the filtering explicitly in your application code. By using Cloud Functions, you can process the data retrieved from Firestore and remove sensitive fields before sending the response. Firestore security rules and IAM roles are important for controlling access but are not sufficient for dynamically restricting returned data in API responses. Query projections are limited in their ability to exclude fields and do not provide the flexibility required in this scenario.
- A. Incorrect.
Firestore security rules control access at the database level but do not allow you to modify the content of returned documents. This option does not restrict sensitive data in the API response.
- B. Correct.
Filtering out sensitive fields in your Cloud Function ensures that only the required fields are included in the API response, effectively restricting the returned data.
- C. Incorrect.
IAM roles control access at a higher level (project or database) and cannot be used to restrict specific fields in Firestore documents.
- D. Incorrect.
Query projections in Firestore allow you to select specific fields to include in the query results, but they are not designed to exclude fields dynamically, especially for filtering based on request context.