Google Professional Data Engineer Question 194
Select 2Google Cloud PlatformYour organization stores sensitive customer data, such as Personally Identifiable Information (PII), in Google Cloud Storage. To comply with regulatory requirements, you need to ensure that only specific users can access this data and that it is protected from accidental exposure. Additionally, you want to regularly scan the storage for any sensitive data to identify risks. What steps should you take to address these requirements?
- A
Assign users the 'Storage Object Viewer' role at the bucket level and use Cloud Data Loss Prevention (Cloud DLP) to scan for sensitive data.
- B
Use IAM conditions to restrict access to the storage bucket based on user attributes and regularly scan the data using Cloud DLP.
- C
Encrypt the storage bucket and assign the 'Storage Admin' role to all users who need access to the data.
- D
Use Cloud DLP inspection jobs to identify sensitive data in Google Cloud Storage and apply fine-grained IAM roles to control bucket access.
- E
Enable public access to the bucket and use Cloud DLP to delete files containing sensitive data.
Show answer and explanation
Correct answers: B, D
Explanation
To comply with regulatory requirements and protect sensitive data, it is essential to limit access using fine-grained IAM roles or IAM conditions, following the principle of least privilege. Cloud DLP can be used to scan for and identify sensitive data in Google Cloud Storage, helping to mitigate risks of accidental exposure. These steps together ensure both access management and data protection are addressed effectively.
- A. Incorrect.
This option is partially correct. Assigning the 'Storage Object Viewer' role at the bucket level provides read-only access but does not offer fine-grained access control for compliance, and Cloud DLP scanning is a valid step.
- B. Correct.
Correct. Using IAM conditions allows you to restrict access to specific users or groups based on attributes like time or IP address. Cloud DLP can then be used to regularly scan for sensitive data, addressing compliance needs.
- C. Incorrect.
Incorrect. Encrypting the bucket is a good security practice, but assigning the 'Storage Admin' role to all users unnecessarily broadens access, violating the principle of least privilege.
- D. Correct.
Correct. Cloud DLP can identify sensitive data in Google Cloud Storage, and using fine-grained IAM roles provides more precise access control, ensuring compliance with regulatory requirements.
- E. Incorrect.
Incorrect. Enabling public access to the bucket violates security best practices, and while Cloud DLP can identify sensitive data, it is not designed to automatically delete files.