Google Professional Cloud Security Engineer Question 290
Select 4Google Cloud PlatformYour organization stores sensitive customer data in Google Cloud Storage. Compliance requirements mandate that this data must be protected against unauthorized access and accidental deletion. As a Professional Cloud Security Engineer, what steps should you take to ensure compliance while minimizing the risk of data loss?
- A
Enable Object Versioning on the Cloud Storage bucket to recover accidentally deleted or overwritten data.
- B
Apply a Bucket Policy Only to enforce IAM policies and prevent unintended access through ACLs.
- C
Encrypt the data using a customer-managed encryption key (CMEK) to maintain control over encryption keys.
- D
Disable public access to the bucket by removing all 'allUsers' and 'allAuthenticatedUsers' permissions.
- E
Enable the default event-based hold on the bucket to prevent accidental deletion of objects.
Show answer and explanation
Correct answers: A, B, C, D
Explanation
To protect sensitive data and prevent data loss, a combination of techniques is required: Object Versioning safeguards against accidental deletion or overwriting, Bucket Policy Only enforces IAM-based access control, CMEK ensures control over encryption keys, and disabling public access prevents unauthorized access. While event-based holds offer additional protection, they are not necessary in this scenario if Object Versioning is enabled.
- A. Correct.
Enabling Object Versioning ensures that older versions of objects are retained, allowing recovery in case of accidental deletion or overwriting.
- B. Correct.
Applying Bucket Policy Only ensures that access is managed solely through IAM policies, eliminating potential risks associated with ACL misconfigurations.
- C. Correct.
Using CMEK for encryption gives your organization control over the encryption keys, which is crucial for compliance and enhanced security.
- D. Correct.
Disabling public access is critical to prevent unauthorized access to the sensitive data stored in the bucket.
- E. Incorrect.
While enabling event-based holds can add a layer of protection, it is not strictly required to meet the compliance requirements in this scenario as Object Versioning already mitigates accidental deletion risks.