Examkin

Question

Difficulty: HardConfiguring Storage Access Controls and Uniform Bucket-Level Access

A healthcare organization is configuring a Google Cloud Storage bucket named `med-research-imaging-archive` to share anonymized medical data with external research partners. Regulatory compliance requires that all storage security policies be unified and administered strictly through IAM, prohibiting any per-object Access Control Lists (ACLs). Additionally, external partners must be granted read access to the stored objects while strictly following the principle of least privilege.

Which TWO configuration steps should the cloud administrator take? (Select TWO)

  1. Enable Uniform Bucket-Level Access on the `med-research-imaging-archive` bucket to disable legacy ACLs and enforce IAM policies across all objects.Answer
  2. Grant the predefined Storage Object Viewer role (`roles/storage.objectViewer`) to the external research partner principal resource directly on the bucket.Answer
  3. C
    Configure per-object Access Control Lists (ACLs) with `READ` permission for the external research partner identity on uploaded dataset objects.
  4. D
    Grant the primitive Viewer role (`roles/viewer`) to the external research partner principal at the parent Google Cloud project level.

Answer

The administrator must enable Uniform Bucket-Level Access on the bucket and grant the predefined Storage Object Viewer role directly on the bucket to the research partner principal.
Enabling Uniform Bucket-Level Access standardizes access control by disabling per-object ACLs and enforcing bucket-level IAM policies across all objects. Granting the predefined Storage Object Viewer role directly on the target bucket ensures external partners can view object content while adhering strictly to the principle of least privilege.

Step-by-Step Solution

1
Enforce unified bucket security governance
Uniform Bucket-Level Access (UBLA) is activated on `gs://med-research-imaging-archive`, disabling object-level ACLs.
UBLA satisfies compliance by forcing all access decisions to evaluate IAM policies instead of object ACLs.
2
Identify the principle of least privilege IAM role for object access
The predefined role `roles/storage.objectViewer` is selected rather than broad primitive roles.
Predefined roles limit permissions strictly to viewing storage objects without exposing administrative operations or unrelated project services.
3
Bind the IAM role at the appropriate resource hierarchy level
The role binding is applied directly to the bucket resource `gs://med-research-imaging-archive`.
Applying the role at the bucket level prevents granting access to other Cloud Storage buckets or resources within the project.

Key Concept

Uniform Bucket-Level Access & IAM Least Privilege
Rate this question

Topics

Configuring Storage Access Controls and Uniform Bucket-Level Access

More questions from this topic