Google Professional Cloud Security Engineer Question 130
Select 2Google Cloud PlatformYour organization wants to allow users in the 'dev-team@example.com' group to access a Cloud Storage bucket, but only during business hours (9 AM to 5 PM, Monday to Friday). At the same time, you want to explicitly deny access to the bucket for a service account 'unauthorized-service@example.gserviceaccount.com' regardless of time. How can you configure this using IAM conditions and IAM deny policies?
- A
Create an IAM allow policy with a condition to grant the 'roles/storage.objectViewer' role to 'dev-team@example.com' for access during business hours.
- B
Create an IAM deny policy to block the 'roles/storage.objectViewer' role for 'unauthorized-service@example.gserviceaccount.com' without any conditions.
- C
Add a condition to the IAM deny policy to block 'unauthorized-service@example.gserviceaccount.com' only outside of business hours.
- D
Grant the 'roles/storage.admin' role to 'dev-team@example.com' without conditions to ensure they always have access.
- E
Set a condition in the IAM allow policy to restrict access for 'unauthorized-service@example.gserviceaccount.com' outside business hours.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements, you need to use an IAM allow policy with conditions to grant time-restricted access to the 'dev-team@example.com' group and an IAM deny policy to explicitly block the 'unauthorized-service@example.gserviceaccount.com' account regardless of time. These configurations ensure proper security and access control for the Cloud Storage bucket.
- A. Correct.
Correct: This option ensures that the 'dev-team@example.com' group has access to the bucket only during business hours by using an IAM allow policy with time-based conditions.
- B. Correct.
Correct: This option explicitly denies access to the 'unauthorized-service@example.gserviceaccount.com' service account with an unconditional deny policy, which is a secure and proper way to block access.
- C. Incorrect.
Incorrect: Adding a condition to block 'unauthorized-service@example.gserviceaccount.com' only outside of business hours does not meet the requirement of denying access regardless of time.
- D. Incorrect.
Incorrect: Granting the 'roles/storage.admin' role without conditions provides excessive permissions and does not restrict access to business hours.
- E. Incorrect.
Incorrect: IAM deny policies are the correct mechanism for denying access. Adding a condition to the IAM allow policy for restricting access is not the correct approach.