Google Professional Cloud Security Engineer Question 292
Select 2Google Cloud PlatformYour organization is using Google Cloud Storage to store sensitive customer data, such as personally identifiable information (PII). To meet compliance requirements and prevent unauthorized access or data loss, which of the following actions should you take? (Select TWO correct answers)
- A
Enable Bucket Lock to make the data immutable and prevent modifications.
- B
Use Customer-Managed Encryption Keys (CMEK) for greater control over encryption keys.
- C
Enable public access to buckets to allow external auditors to access the data directly.
- D
Set up VPC Service Controls to prevent data exfiltration to unauthorized networks.
- E
Disable Object Versioning to reduce storage costs and simplify bucket management.
Show answer and explanation
Correct answers: B, D
Explanation
To protect sensitive data and prevent data loss, it is essential to encrypt sensitive data using Customer-Managed Encryption Keys (CMEK) for better control and compliance. Additionally, setting up VPC Service Controls ensures that sensitive data is protected from unauthorized access or exfiltration by defining service perimeters. Other options either do not address the core issues (e.g., disabling Object Versioning) or introduce security risks (e.g., enabling public access to buckets).
- A. Incorrect.
Enabling Bucket Lock ensures data immutability, which is useful for regulatory compliance but does not directly address encryption or preventing data exfiltration.
- B. Correct.
Using Customer-Managed Encryption Keys (CMEK) provides additional control over encryption keys, ensuring sensitive data is encrypted with keys managed by your organization.
- C. Incorrect.
Enabling public access to buckets is highly discouraged as it can expose sensitive data to unauthorized access, violating compliance requirements.
- D. Correct.
Setting up VPC Service Controls helps prevent data exfiltration by creating service perimeters, ensuring that sensitive data cannot be accessed or transferred to unauthorized networks.
- E. Incorrect.
Disabling Object Versioning may help reduce costs but increases the risk of accidental data loss, as previous versions of objects cannot be recovered.