Google Professional Cloud Security Engineer Question 126
Single answerGoogle Cloud PlatformYour organization uses a Google Cloud Storage bucket to store sensitive financial reports. You need to ensure that only members of the 'finance-team' Google Group can access the bucket, but you also want to restrict access to the bucket during weekends and outside of business hours (9 AM to 5 PM, Monday to Friday). How can you achieve this using IAM permissions?
- A
Grant the 'finance-team' Google Group the 'roles/storage.objectViewer' role with an IAM condition that specifies the allowed days and times.
- B
Grant the 'finance-team' Google Group the 'roles/storage.objectViewer' role, then create an IAM deny policy to block access outside of business hours and weekends.
- C
Grant the 'finance-team' Google Group the 'roles/storage.objectViewer' role without any conditions, and use Cloud Scheduler to temporarily disable the role outside of business hours.
- D
Grant the 'finance-team' Google Group the 'roles/storage.objectViewer' role, but use VPC Service Controls to enforce time-based restrictions.
Show answer and explanation
Correct answer: A
Explanation
IAM conditions are the correct tool for implementing time-based access restrictions in Google Cloud. By adding a condition to the 'roles/storage.objectViewer' role granted to the 'finance-team' Google Group, you can specify the allowed access days and times. This ensures that the group members can only access the bucket during the predefined business hours and prevents unauthorized access outside of those times. Other options, such as IAM deny policies or Cloud Scheduler, are not designed for time-based access control.
- A. Correct.
Correct. IAM conditions allow you to grant roles based on specific conditions, such as time-based restrictions. This is the appropriate solution for restricting access to the bucket during weekends and outside business hours.
- B. Incorrect.
Incorrect. IAM deny policies are used to explicitly block access, but they cannot enforce time-based restrictions. This option does not satisfy the requirement.
- C. Incorrect.
Incorrect. Cloud Scheduler cannot directly manage IAM roles or permissions. This approach is not feasible for implementing time-based access control.
- D. Incorrect.
Incorrect. VPC Service Controls are used to define security perimeters for managing data access across Google Cloud services, but they do not support time-based restrictions.