Google Professional Cloud Security Engineer Question 299
Select 3Google Cloud PlatformYour organization stores sensitive customer data in Google Cloud Storage buckets and uses BigQuery for analytics. You have been tasked with ensuring that only specific teams within your organization can access certain datasets and storage buckets, while minimizing the risk of accidental exposure. Which of the following actions should you take to achieve this?
- A
Use Identity and Access Management (IAM) roles to grant permissions at the bucket or dataset level.
- B
Set up VPC Service Controls to define a security perimeter around your storage and BigQuery resources.
- C
Grant the roles/owner IAM role to team members for the associated projects to ensure they have full access.
- D
Use Cloud KMS (Key Management Service) to encrypt sensitive data and ensure only authorized users can decrypt it.
- E
Enable public access on the storage bucket but configure signed URLs for team members to access the data.
Show answer and explanation
Correct answers: A, B, D
Explanation
Restricting access to sensitive data in Google Cloud requires implementing the principle of least privilege using IAM roles, defining security perimeters with VPC Service Controls, and leveraging encryption mechanisms like Cloud KMS. Avoid granting excessive permissions or enabling public access, as these practices increase the risk of exposure and data breaches.
- A. Correct.
Using IAM roles at the bucket or dataset level allows you to grant the principle of least privilege by controlling access to specific resources.
- B. Correct.
VPC Service Controls help define a security perimeter to prevent data exfiltration and unauthorized access to sensitive data.
- C. Incorrect.
Granting the roles/owner IAM role provides excessive permissions, violating the principle of least privilege and increasing the risk of accidental or malicious misuse.
- D. Correct.
Using Cloud KMS to encrypt sensitive data adds an additional layer of security, ensuring that only authorized users with decryption permissions can access the data.
- E. Incorrect.
Enabling public access on a storage bucket is highly insecure, even if signed URLs are used, as it increases the risk of accidental exposure to unauthorized users.