Google Professional Data Engineer Question 196
Select 3Google Cloud PlatformYour organization stores sensitive customer data, including personally identifiable information (PII), in Google Cloud Storage. To comply with regulatory requirements, you need to ensure that all users accessing this data have the appropriate permissions and that sensitive data is automatically redacted in logs or analysis workflows. Which of the following actions should you take to achieve these goals?
- A
Grant users the 'Storage Admin' role at the project level to manage Cloud Storage permissions.
- B
Use Cloud DLP to scan and redact sensitive data before storing it in logs or analysis workflows.
- C
Grant users the 'Viewer' role at the bucket level to restrict access to read-only for specific storage buckets.
- D
Implement IAM policies to assign the principle of least privilege to users accessing Cloud Storage.
- E
Enable Cloud Audit Logs for Cloud Storage and integrate with Cloud DLP to redact sensitive data in logs.
Show answer and explanation
Correct answers: B, D, E
Explanation
To comply with regulatory requirements and protect sensitive data, you need to implement both access control and data protection mechanisms. Granting broad roles like 'Storage Admin' is against best practices, so specific IAM policies should be used to enforce the principle of least privilege. Cloud DLP should be used to identify and redact sensitive data in workflows, logs, or storage to ensure compliance. Additionally, integrating Cloud DLP with Cloud Audit Logs ensures sensitive information is not exposed in audit trails.
- A. Incorrect.
Granting the 'Storage Admin' role at the project level is not recommended because it provides overly broad permissions, violating the principle of least privilege.
- B. Correct.
Using Cloud DLP to scan and redact sensitive data ensures that sensitive information like PII is protected when stored or processed, aligning with compliance requirements.
- C. Incorrect.
Granting the 'Viewer' role at the bucket level limits access but does not address sensitive data redaction or the principle of least privilege for all users.
- D. Correct.
Implementing IAM policies with the principle of least privilege ensures that users only have the minimum permissions required, enhancing security.
- E. Correct.
Enabling Cloud Audit Logs for Cloud Storage and integrating with Cloud DLP ensures that sensitive data is redacted in audit logs, helping meet regulatory requirements.