Google Professional Cloud Security Engineer Question 121
Select 2Google Cloud PlatformYour organization recently implemented a Google Cloud Storage bucket to store sensitive files. You want to ensure that only specific users and groups have the necessary access to these files while minimizing the risk of excessive permissions. Which of the following actions should you take to properly configure access to the bucket and its objects?
- A
Use IAM roles to assign permissions at the bucket level to control access for users and groups.
- B
Set object-level ACLs for each file to provide fine-grained access control.
- C
Use the 'allAuthenticatedUsers' IAM role to allow authenticated users to access the bucket.
- D
Apply the Principle of Least Privilege by granting only the minimum permissions required for each user or group.
- E
Disable Uniform Bucket-Level Access to allow for more granular access control using ACLs.
Show answer and explanation
Correct answers: A, D
Explanation
To manage IAM and ACL permissions effectively in Google Cloud, you should prioritize using IAM roles at the bucket level and follow the Principle of Least Privilege. These practices ensure a secure and scalable way to control access to sensitive data while minimizing risks. ACLs and legacy access methods, such as disabling Uniform Bucket-Level Access, should be avoided unless absolutely necessary.
- A. Correct.
Using IAM roles at the bucket level is the recommended approach in Google Cloud for managing access, as it simplifies permission management, scales better, and aligns with best practices.
- B. Incorrect.
While ACLs can be used for fine-grained access control, they are generally discouraged in favor of using IAM policies for consistency and simplicity, especially when Uniform Bucket-Level Access is enabled.
- C. Incorrect.
Granting the 'allAuthenticatedUsers' role would expose the bucket to any authenticated Google Account user, which is a significant security risk for sensitive data.
- D. Correct.
Applying the Principle of Least Privilege ensures that users and groups have only the permissions they need, reducing the risk of accidental or malicious misuse of access.
- E. Incorrect.
Disabling Uniform Bucket-Level Access is not recommended as it reverts to legacy access control methods, which are more complex and prone to misconfigurations.