Google Professional Cloud Network Engineer Question 522
Select 3Google Cloud PlatformYour company hosts static assets in a Google Cloud Storage bucket, and you need to allow temporary secure access to specific files for an external vendor. The vendor should only be able to download the files for a limited duration. Which of the following steps are required to configure signed URLs correctly?
- A
Generate a service account key file and use it to sign the URL.
- B
Ensure the bucket's IAM policy grants 'Storage Object Viewer' role to the external vendor.
- C
Set an expiration time for the signed URL when generating it.
- D
Use the 'gsutil signurl' command to create the signed URL.
- E
Enable Object Versioning in the Google Cloud Storage bucket.
Show answer and explanation
Correct answers: A, C, D
Explanation
To configure signed URLs for temporary secure access to Google Cloud Storage objects, you need to use a service account key to sign the URL, specify an expiration time, and optionally use tools like 'gsutil signurl' to generate the signed URL. IAM roles are not required because the signed URL itself provides temporary access without relying on bucket permissions. Object Versioning is unrelated to signed URLs and does not play a role in this configuration.
- A. Correct.
This is correct. A service account key file is required to cryptographically sign the URL, which ensures the URL is secure and valid for temporary access.
- B. Incorrect.
This is incorrect. IAM policies are not required for signed URLs because the URL itself grants temporary access to the object. IAM roles are bypassed when using signed URLs.
- C. Correct.
This is correct. The expiration time is a required parameter when generating a signed URL, as it defines the duration for which the URL is valid.
- D. Correct.
This is correct. The 'gsutil signurl' command is one of the methods to generate signed URLs in Google Cloud.
- E. Incorrect.
This is incorrect. Enabling Object Versioning is unrelated to generating or configuring signed URLs.