Google Professional Cloud Security Engineer Question 131
Select 2Google Cloud PlatformYour organization uses Google Cloud to host sensitive data and requires fine-grained control over access. You are tasked with creating an IAM policy for a Cloud Storage bucket. The policy should grant 'Storage Object Viewer' permissions to all members of the 'dev-team' group only during business hours (9 AM to 5 PM). Additionally, you need to ensure that external identities (users outside your domain) are permanently denied access to the bucket. Which actions should you take to implement this requirement?
- A
Use an IAM condition with a time-based constraint to grant 'Storage Object Viewer' permissions to the 'dev-team' group.
- B
Use an IAM deny policy to block all external identities from accessing the bucket.
- C
Grant the 'Storage Object Viewer' role to the 'dev-team' group without specifying any conditions.
- D
Use an IAM condition to restrict access to external identities by domain.
- E
Configure a VPC Service Control perimeter around the bucket to block external access.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements, you must use IAM conditions to implement fine-grained access control for the 'dev-team' group during specific business hours and use IAM deny policies to explicitly block access for external identities. These two mechanisms together ensure compliance with the organization's security and access control policies.
- A. Correct.
Correct: IAM conditions can be used to grant permissions based on specific attributes such as time. In this case, a time-based constraint is the correct way to allow 'Storage Object Viewer' access only during business hours.
- B. Correct.
Correct: IAM deny policies provide a mechanism to explicitly block access to resources for specific identities, such as external users. This ensures that external identities cannot access the bucket at any time.
- C. Incorrect.
Incorrect: Granting the role without conditions would provide unrestricted access to the 'dev-team' group, which does not meet the requirement of limiting access to business hours.
- D. Incorrect.
Incorrect: IAM conditions cannot directly restrict access based on external domains. Instead, deny policies should be used to explicitly block external identities.
- E. Incorrect.
Incorrect: VPC Service Controls are used to create security perimeters for services, but this does not directly fulfill the requirement to block external identities or implement time-based conditions.