Examkin

Question

Difficulty: MediumConfiguring Storage Access Controls and Uniform Bucket-Level Access

A security administrator is standardizing access controls on a Cloud Storage bucket named `financial-reports-archive` to align with organizational security guidelines. The bucket currently contains objects with legacy fine-grained Access Control Lists (ACLs), but company policy requires that all access be managed exclusively through Cloud IAM permissions. Which TWO configuration steps must the administrator perform to achieve this requirement following Google Cloud security best practices? (Select TWO.)

  1. Enable Uniform Bucket-Level Access on the bucket to disable Access Control Lists (ACLs) across all objects.Answer
  2. Assign predefined Cloud IAM roles, such as Storage Object Viewer or Storage Object Admin, to principals at the bucket or project level.Answer
  3. C
    Apply per-object Access Control List (ACL) read entries to individual financial documents using Cloud Storage commands.
  4. D
    Grant the primitive Editor role to authorized team members at the bucket level to override existing object ACLs.

Answer

Enabling Uniform Bucket-Level Access on the target Cloud Storage bucket and granting predefined IAM roles (such as Storage Object Viewer) at the bucket or project level.
To standardize storage access controls to Cloud IAM only, administrators must enable Uniform Bucket-Level Access on the bucket. This action disables per-object ACLs, ensuring all object access is controlled via IAM permissions. Combining this setting with specific predefined roles (such as Storage Object Viewer) ensures least-privilege permissions managed centrally.

Step-by-Step Solution

1
Enable Uniform Bucket-Level Access on the Cloud Storage bucket.
Disables fine-grained object-level Access Control Lists (ACLs) so that access evaluations rely strictly on Cloud IAM policies.
Uniform Bucket-Level Access ensures consistent security governance across all current and future objects in the bucket.
2
Grant appropriate predefined IAM roles to authorized users or service accounts.
Provides required read or admin access to storage objects via Cloud IAM without granting overly broad permissions.
Predefined roles follow the security best practice of least privilege.

Key Concept

Uniform Bucket-Level Access (UBLA) and IAM Access Management
Rate this question

Topics

Configuring Storage Access Controls and Uniform Bucket-Level Access

More questions from this topic