Google Professional Cloud Network Engineer Question 520
Select 3Google Cloud PlatformYou are implementing a solution to allow temporary access to private objects stored in a Google Cloud Storage bucket. The access should be restricted to a specific user for a limited time without requiring them to authenticate with Google Cloud. Which of the following steps must you take to configure and use signed URLs correctly?
- A
Generate a signed URL using a service account's private key.
- B
Ensure the bucket's IAM policy grants public read access to all users.
- C
Specify an expiration time for the signed URL.
- D
Use the Google Cloud Console to manually create the signed URL.
- E
Distribute the signed URL to the intended user.
Show answer and explanation
Correct answers: A, C, E
Explanation
Signed URLs allow for secure, temporary access to private objects in Google Cloud Storage without requiring user authentication. To configure signed URLs, you must generate them using a service account's private key, specify an expiration time, and share the URL with the intended user. Granting public access or manually creating signed URLs in the console are not valid actions in this context.
- A. Correct.
Correct: Signed URLs are generated using the private key of a service account. This ensures the URL is cryptographically secure and uniquely signed.
- B. Incorrect.
Incorrect: Granting public read access to the bucket contradicts the purpose of signed URLs, which provide temporary, restricted access to private objects.
- C. Correct.
Correct: Signed URLs must include an expiration time to limit how long they provide access to the object.
- D. Incorrect.
Incorrect: Signed URLs cannot be created manually in the Google Cloud Console. They must be generated programmatically or via the
gsutilcommand-line tool. - E. Correct.
Correct: Distributing the signed URL to the intended user is necessary for them to access the private object.