Google Professional Cloud Security Engineer exam dumps

Google Professional Cloud Security Engineer practice question 129 of 501

Professional Cloud Security Engineer. Expert level, Google Cloud. Free question with the correct answer and a full explanation.

Google Professional Cloud Security Engineer Question 129

Select 2Google Cloud Platform

You are a security engineer for a company that uses Google Cloud. The company requires that only members of the 'data-analysts' group can access a specific BigQuery dataset, but only during business hours (9 AM to 6 PM, Monday to Friday). Additionally, the engineering team has requested that no user, regardless of role, can delete the dataset. How can you implement this requirement using IAM conditions and IAM deny policies?

  1. A

    Create an IAM allow policy that grants the 'roles/bigquery.dataViewer' role to the 'data-analysts' group with a condition specifying the allowed time window.

  2. B

    Create an IAM allow policy that grants the 'roles/bigquery.dataEditor' role to the 'data-analysts' group with a condition specifying the allowed time window.

  3. C

    Create an IAM deny policy for all users that denies the 'bigquery.datasets.delete' permission.

  4. D

    Create an IAM deny policy for the 'data-analysts' group that denies the 'bigquery.datasets.delete' permission.

  5. E

    Create an IAM allow policy for all users that grants the 'roles/bigquery.dataViewer' role without any conditions.

Show answer and explanation

Correct answers: A, C

Explanation

To meet the requirements, you need to use both IAM conditions and IAM deny policies. The IAM allow policy with a condition ensures that only the 'data-analysts' group can access the dataset during the specified time window. The IAM deny policy prevents all users from deleting the dataset, ensuring the dataset's integrity. These configurations together implement the security and operational constraints effectively.

  • A. Correct.

    Correct: An IAM allow policy with a condition specifying the time window ensures that the 'data-analysts' group can access the dataset only during business hours.

  • B. Incorrect.

    Incorrect: The 'roles/bigquery.dataEditor' role includes additional permissions beyond just viewing data, which is not required in this scenario.

  • C. Correct.

    Correct: An IAM deny policy for all users prevents the deletion of the dataset, meeting the requirement that no user can delete it.

  • D. Incorrect.

    Incorrect: Denying the 'bigquery.datasets.delete' permission specifically for the 'data-analysts' group does not cover other users, leaving the dataset vulnerable to deletion by other identities.

  • E. Incorrect.

    Incorrect: Allowing all users to access the dataset without any conditions violates the requirement of restricting access to the 'data-analysts' group during business hours.

Timed practice exam

Take a Google Professional Cloud Security Engineer practice test under exam conditions

60 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

More Google Professional Cloud Security Engineer practice questions

  1. 130.Your organization wants to allow users in the 'dev-team@example.com' group to access a Cloud...
  2. 131.Your organization uses Google Cloud to host sensitive data and requires fine-grained control over...
  3. 132.You are designing access control policies for a company's Google Cloud environment. The company...
  4. 133.Your organization is migrating to Google Cloud and has strict security policies requiring the...
  5. 134.Your company uses Google Cloud and manages multiple projects, each belonging to different...
Back to the Google Professional Cloud Security Engineer exam dumps