A cloud engineer needs to deploy a new Google Cloud Storage bucket to store confidential compliance reports. Security guidelines require that access permissions are enforced uniformly across all objects using IAM policies instead of per-object Access Control Lists (ACLs), and that data is encrypted using a Customer-Managed Encryption Key (CMEK). Which TWO configurations must the engineer apply to the Cloud Storage bucket to satisfy these requirements? (Select TWO choices.)
- Enable Uniform Bucket-Level Access on the bucket.Cevap
- Configure the bucket's default Cloud KMS key (--default-kms-key) with the CMEK resource path.Cevap
- CApply individual ACL entries to each object using fine-grained object access controls.
- DGrant project-wide Owner primitive roles to users needing access to the bucket objects.
Cevap
Enabling Uniform Bucket-Level Access and setting the bucket's default Cloud KMS key (--default-kms-key) fulfill the requirements for centralized IAM access control and Customer-Managed Encryption Keys.
Enabling Uniform Bucket-Level Access ensures that Cloud Storage uses Google Cloud IAM exclusively for access control, ignoring per-object ACLs. Setting the default KMS key ensures that all objects uploaded to the bucket are encrypted using the specified Customer-Managed Encryption Key (CMEK). Together, these two settings satisfy both security mandates.
Adım Adım Çözüm
Anahtar Kavram
Configuring Cloud Storage access controls and CMEK encryption settings
Tahmini Süre:1m 0s