Google Professional Cloud Security Engineer Question 289
Select 4Google Cloud PlatformYour organization stores sensitive customer data in a Google Cloud Storage bucket. To comply with regulatory requirements and prevent unauthorized access or accidental data exposure, you need to implement measures to protect this data effectively. Which of the following approaches should you implement?
- A
Enable bucket-level ACLs and assign 'Storage Object Admin' role to all team members.
- B
Enable Object Versioning on the bucket to recover accidentally overwritten or deleted data.
- C
Use Customer-Managed Encryption Keys (CMEK) to encrypt the data in the bucket.
- D
Set up VPC Service Controls to define a security perimeter around the storage bucket.
- E
Enable Uniform Bucket-Level Access and use IAM roles to control permissions.
Show answer and explanation
Correct answers: B, C, D, E
Explanation
To protect sensitive data and prevent data loss in Google Cloud Storage, you should implement multiple defensive measures. Using Object Versioning allows recovery of overwritten or deleted objects, while CMEK ensures robust encryption under your control. VPC Service Controls help secure data by restricting access through defined perimeters, and Uniform Bucket-Level Access with IAM roles simplifies and strengthens access control. Avoid granting excessive permissions to users, as this increases the risk of unauthorized access or accidental changes.
- A. Incorrect.
Assigning 'Storage Object Admin' to all team members is not a secure practice. It grants excessive permissions, increasing the risk of unauthorized access or accidental actions.
- B. Correct.
Enabling Object Versioning helps protect against accidental data loss by allowing recovery of older versions of objects. This is a recommended best practice.
- C. Correct.
Using Customer-Managed Encryption Keys (CMEK) ensures that encryption keys are managed and controlled by your organization, enhancing the security of sensitive data.
- D. Correct.
VPC Service Controls strengthen security by preventing data exfiltration and defining a security perimeter, which is crucial for sensitive data protection.
- E. Correct.
Enabling Uniform Bucket-Level Access simplifies permission management and ensures IAM roles are used for fine-grained access control, reducing the risk of misconfigurations.