Google Professional Cloud Security Engineer Question 291
Select 3Google Cloud PlatformYour company stores sensitive customer data in Google Cloud Storage buckets. To comply with regulatory requirements, you need to ensure data is encrypted at rest and that unauthorized users cannot download or access the data. Additionally, you want to monitor and prevent any accidental data loss. Which combination of security controls would best address these requirements?
- A
Enable Bucket Policy Only (BPO) and configure Identity and Access Management (IAM) roles appropriately.
- B
Use Customer-Managed Encryption Keys (CMEK) with Cloud Storage buckets to encrypt data at rest.
- C
Enable Object Versioning on the bucket to prevent accidental data loss.
- D
Enable Cloud Data Loss Prevention (DLP) API to scan and redact sensitive data.
- E
Set up VPC Service Controls to restrict data exfiltration from Cloud Storage.
Show answer and explanation
Correct answers: B, D, E
Explanation
To meet the requirements for protecting sensitive data, you need to encrypt data at rest using Customer-Managed Encryption Keys (CMEK). Additionally, enabling Cloud Data Loss Prevention (DLP) helps monitor and prevent accidental data exposure. Finally, setting up VPC Service Controls establishes a security perimeter that restricts unauthorized data exfiltration. These combined measures ensure compliance with regulatory requirements and secure sensitive data effectively.
- A. Incorrect.
While enabling Bucket Policy Only (BPO) and configuring IAM roles helps manage access, it does not directly address encryption or prevent data exfiltration, making it insufficient for this scenario.
- B. Correct.
Using Customer-Managed Encryption Keys (CMEK) ensures that data is encrypted at rest with keys you control, meeting the encryption requirement.
- C. Incorrect.
Object Versioning helps recover deleted or overwritten objects, but it does not prevent data loss through unauthorized access or ensure compliance with encryption requirements.
- D. Correct.
Enabling Cloud Data Loss Prevention (DLP) API allows you to identify, monitor, and redact sensitive data, which is crucial for preventing accidental data exposure and ensuring compliance.
- E. Correct.
VPC Service Controls help restrict data exfiltration by defining a security perimeter around Cloud Storage, which is essential for preventing unauthorized access to sensitive data.