Google Professional Cloud Security Engineer Question 303
Select 3Google Cloud PlatformYour organization uses Google Cloud Storage to store sensitive financial records. To comply with your organization's security policy, you must ensure that only members of the 'FinanceTeam' Google Group can access these records, and their access must be read-only. Additionally, external access should be blocked entirely. Which of the following steps should you take to achieve this?
- A
Create a bucket-level IAM policy granting the 'roles/storage.objectViewer' role to the 'FinanceTeam' Google Group.
- B
Use a VPC Service Controls perimeter to restrict access to the bucket from external networks.
- C
Grant the 'roles/storage.admin' role to the 'FinanceTeam' Google Group to allow full access to the bucket.
- D
Remove the 'allUsers' and 'allAuthenticatedUsers' members, if present, from the bucket's IAM policy.
- E
Enable Object Versioning on the bucket to track changes to stored files.
Show answer and explanation
Correct answers: A, B, D
Explanation
To restrict access to Google Cloud Storage for sensitive data, you must carefully configure IAM roles and policies to ensure that only authorized users or groups have appropriate access. In this scenario, granting 'roles/storage.objectViewer' to the 'FinanceTeam' satisfies the read-only requirement. Additionally, removing broad permissions (such as 'allUsers' and 'allAuthenticatedUsers') and implementing a VPC Service Controls perimeter ensures external access is fully blocked. These combined steps meet the organization's security requirements effectively.
- A. Correct.
Correct. Granting the 'roles/storage.objectViewer' role to the 'FinanceTeam' Google Group ensures that group members have read-only access to the bucket's objects, fulfilling the requirement of the security policy.
- B. Correct.
Correct. Using a VPC Service Controls perimeter helps prevent unauthorized external access to the bucket, enhancing security compliance.
- C. Incorrect.
Incorrect. Granting the 'roles/storage.admin' role would provide full administrative access, which violates the requirement of read-only access for the 'FinanceTeam'.
- D. Correct.
Correct. Removing the 'allUsers' and 'allAuthenticatedUsers' members from the bucket's IAM policy ensures that no unauthorized external access is permitted, meeting part of the security requirement.
- E. Incorrect.
Incorrect. While enabling Object Versioning can be useful for tracking changes, it does not address access restrictions or external access controls, which are the focus of this scenario.