Google Professional Cloud Security Engineer Question 293
Select 4Google Cloud PlatformYour organization stores sensitive customer data in Cloud Storage. To comply with regulatory standards and prevent data loss, you are tasked with implementing a solution that ensures sensitive data is encrypted at rest, access is strictly controlled, and accidental deletions are mitigated. Which combination of steps should you take?
- A
Enable Object Versioning on the Cloud Storage bucket.
- B
Use Customer-Managed Encryption Keys (CMEK) for encrypting Cloud Storage objects.
- C
Grant the 'Storage Admin' role to all users who need access to the bucket.
- D
Set up a VPC Service Controls perimeter around the Cloud Storage bucket.
- E
Enable logging and monitoring using Cloud Audit Logs for Cloud Storage.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To protect sensitive data and prevent data loss in Cloud Storage, you should combine encryption (e.g., CMEK) to secure data at rest, VPC Service Controls to restrict access, Object Versioning to recover from accidental deletions, and Cloud Audit Logs to monitor activity. Granting excessive permissions, such as through the 'Storage Admin' role, violates security best practices, so it is not a valid step in this scenario.
- A. Correct.
Enabling Object Versioning allows you to keep multiple versions of an object in case of accidental deletion or modification, which helps mitigate data loss.
- B. Correct.
Using CMEK gives you full control over encryption keys, ensuring that sensitive data stored in Cloud Storage is encrypted at rest with keys you manage.
- C. Incorrect.
Granting the 'Storage Admin' role to multiple users could lead to excessive permissions and increase the risk of unauthorized access, violating the principle of least privilege.
- D. Correct.
Setting up a VPC Service Controls perimeter creates an additional layer of security by restricting access to Cloud Storage from unauthorized networks and services.
- E. Correct.
Cloud Audit Logs for Cloud Storage provide visibility into access and changes, helping you monitor and respond to suspicious activity.