Google Professional Cloud Security Engineer Question 288
Select 3Google Cloud PlatformYour company stores sensitive customer information in Cloud Storage buckets. To comply with regulatory requirements, you need to ensure that this data is encrypted, access is restricted to authorized users only, and no sensitive data is accidentally exposed. Which combination of security measures should you implement to meet these requirements?
- A
Enable Bucket Policy Only to enforce IAM policies on the Cloud Storage bucket.
- B
Use Customer-Managed Encryption Keys (CMEK) to encrypt the data in the bucket.
- C
Set the Cloud Storage bucket to 'public' for easier access control.
- D
Implement VPC Service Controls to prevent unauthorized data exfiltration.
- E
Enable Object Versioning on the bucket to track changes and accidental deletions.
Show answer and explanation
Correct answers: A, B, D
Explanation
To protect sensitive data and comply with regulatory requirements, you need to implement multiple layers of security. Enabling Bucket Policy Only restricts access to authorized users, Customer-Managed Encryption Keys (CMEK) ensures encryption compliance, and VPC Service Controls prevent unauthorized data exfiltration. These combined measures address access control, encryption, and data loss prevention effectively.
- A. Correct.
Enabling Bucket Policy Only ensures that only IAM policies are used for access control, which helps restrict access to authorized users.
- B. Correct.
Using Customer-Managed Encryption Keys (CMEK) allows you to control the encryption keys and ensures compliance with encryption requirements.
- C. Incorrect.
Setting the bucket to 'public' would expose sensitive data and violate security best practices and regulatory requirements.
- D. Correct.
Implementing VPC Service Controls helps define secure perimeters and prevents unauthorized data exfiltration, which is essential for data protection.
- E. Incorrect.
While Object Versioning is useful for tracking changes and accidental deletions, it does not directly address encryption, access control, or data exposure risks.