Google Professional Cloud Network Engineer Question 521
Single answerGoogle Cloud PlatformYou are designing a secure way to allow users to download a file stored in a Google Cloud Storage bucket without exposing the file publicly. The access should be time-limited, and the URL should only be usable by the intended user. How can you achieve this using signed URLs?
- A
Generate a signed URL with an appropriate expiration time and share it with the user.
- B
Configure the bucket's IAM policy to allow public access temporarily and revoke it after the download.
- C
Use a signed URL with a short expiration time and restrict access to a specific IP address.
- D
Enable the 'public' ACL for the object and share the public URL.
Show answer and explanation
Correct answer: C
Explanation
Signed URLs allow you to grant secure, time-limited access to a specific object in a Google Cloud Storage bucket. By including additional restrictions, such as IP address filtering, you can ensure that the URL is usable only by the intended user and within the specified time frame. This approach provides a secure and user-specific way to share files without making them publicly accessible.
- A. Incorrect.
This is a valid solution, but it does not add an additional layer of security, such as restricting access to specific IP addresses, which was a requirement in the scenario.
- B. Incorrect.
Granting public access to the bucket, even temporarily, is not secure and does not meet the requirements for a time-limited and user-specific download.
- C. Correct.
This is the correct solution. A signed URL with a short expiration time and IP restriction ensures the download is both time-limited and accessible only by the intended user.
- D. Incorrect.
Enabling the 'public' ACL for the object makes the file publicly accessible, which is not secure and does not meet the requirement for user-specific access.