Google Professional Cloud Security Engineer Question 300
Select 3Google Cloud PlatformYou are a security engineer for a company that uses Google Cloud extensively. The company stores sensitive financial data in BigQuery and critical application logs in Cloud Storage. To comply with regulatory requirements, you must ensure that only specific users and service accounts can access these data services. Which of the following actions should you take to restrict access effectively?
- A
Use Identity and Access Management (IAM) roles to assign least-privilege permissions to users and service accounts.
- B
Enable VPC Service Controls to create service perimeters around BigQuery and Cloud Storage.
- C
Make the BigQuery dataset and Cloud Storage bucket public to simplify access management.
- D
Use Access Context Manager to define access levels and enforce contextual restrictions for access to BigQuery and Cloud Storage.
- E
Disable IAM permissions inheritance to ensure that access is only granted explicitly.
Show answer and explanation
Correct answers: A, B, D
Explanation
To restrict access to Google Cloud data services like BigQuery and Cloud Storage, you should use IAM to assign least-privilege permissions, VPC Service Controls to create service perimeters, and Access Context Manager to enforce contextual access restrictions. These measures align with best practices for securing sensitive data. Making resources public would expose your data, and disabling IAM inheritance is not a valid option in Google Cloud.
- A. Correct.
Correct: IAM roles allow you to enforce the principle of least privilege, ensuring that users and service accounts only have the permissions they need for their job.
- B. Correct.
Correct: VPC Service Controls add an additional layer of security by defining service perimeters, which prevent data exfiltration and unauthorized access to data services like BigQuery and Cloud Storage.
- C. Incorrect.
Incorrect: Making resources public would violate security and regulatory requirements, exposing sensitive data to unauthorized access.
- D. Correct.
Correct: Access Context Manager allows you to create context-aware access policies, such as enforcing restrictions based on user location or device type, which is critical for securing sensitive data.
- E. Incorrect.
Incorrect: Disabling IAM permissions inheritance is not a valid feature in Google Cloud and would not address the access control requirements.