Google Professional Cloud Security Engineer Question 124
Single answerGoogle Cloud PlatformYour organization uses Google Cloud Storage to host sensitive financial reports. A junior engineer has mistakenly shared a bucket containing these reports with 'allAuthenticatedUsers'. You need to restrict access to only the finance team while ensuring the least privilege principle. What action should you take?
- A
Modify the bucket ACL to remove 'allAuthenticatedUsers' and add the finance team members with specific permissions.
- B
Modify the bucket IAM policy to remove 'allAuthenticatedUsers' and add a custom role assigned to the finance team.
- C
Delete the bucket and recreate it with restricted access settings.
- D
Leave the 'allAuthenticatedUsers' permission in place and use Object ACLs to restrict access to individual objects.
Show answer and explanation
Correct answer: B
Explanation
The recommended approach for managing access in Google Cloud is to use IAM policies rather than ACLs, as IAM provides centralized, scalable, and easier-to-audit access management. By removing 'allAuthenticatedUsers' from the bucket IAM policy and assigning a custom role to the finance team, you ensure that access is restricted to the appropriate users while adhering to the principle of least privilege.
- A. Incorrect.
While ACLs can be used to control access, Google recommends using IAM policies for better manageability and scalability. This option does not align with best practices.
- B. Correct.
This is the correct choice because IAM policies should be used to manage access, ensuring the 'allAuthenticatedUsers' role is removed and replaced with a custom role that grants only the required permissions to the finance team.
- C. Incorrect.
Deleting and recreating the bucket is unnecessary and can lead to data loss or downtime. The issue can be resolved using IAM policies without deleting the bucket.
- D. Incorrect.
Leaving 'allAuthenticatedUsers' in place violates the principle of least privilege. Object ACLs cannot override IAM policies granting broad access at the bucket level.