Google Professional Cloud Security Engineer Question 301
Select 4Google Cloud PlatformYou are a security engineer at an organization that stores sensitive data in Google Cloud Storage, BigQuery, and Cloud SQL. A recent audit revealed that some employees have more access than necessary to these data services. To follow the principle of least privilege and mitigate this risk, what steps should you take to restrict access appropriately?
- A
Implement Identity and Access Management (IAM) roles with the minimum required permissions for users.
- B
Enable Public Access Prevention on Cloud Storage buckets.
- C
Use VPC Service Controls to define service perimeters around your data services.
- D
Grant the 'roles/owner' IAM role to all team members to ensure they have broad access to troubleshoot any issues.
- E
Review and remove any unused service accounts with access to your data services.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To restrict access to Google Cloud data services like Cloud Storage, BigQuery, and Cloud SQL, it's crucial to follow the principle of least privilege by assigning minimal IAM roles, enabling Public Access Prevention for sensitive data, implementing VPC Service Controls, and removing unused service accounts. Avoid granting over-permissive roles like 'roles/owner' to prevent unnecessary access and potential misuse.
- A. Correct.
Correct: Assigning IAM roles with the minimum required permissions ensures that users have only the necessary access to perform their tasks, following the principle of least privilege.
- B. Correct.
Correct: Enabling Public Access Prevention on Cloud Storage buckets minimizes the risk of unauthorized access by ensuring that buckets cannot be publicly accessible.
- C. Correct.
Correct: VPC Service Controls add an additional layer of security by creating service perimeters that restrict unauthorized data movement between services and external networks.
- D. Incorrect.
Incorrect: Granting the 'roles/owner' IAM role provides excessive permissions, violating the principle of least privilege. This role should only be used sparingly for administrative purposes.
- E. Correct.
Correct: Reviewing and removing unused service accounts is a best practice to reduce the attack surface and prevent unauthorized access to data services.