Examkin

Soru

Zorluk: ZorConfiguring Storage Access Controls and Uniform Bucket-Level Access

A cloud security engineer needs to enforce uniform security policies for a Google Cloud Storage bucket storing sensitive financial reports. The bucket currently has legacy per-object Access Control Lists (ACLs) applied. The engineer plans to enable Uniform Bucket-Level Access (UBLA) on this bucket. Which of the following statements correctly describe the technical impacts and operational requirements of enabling Uniform Bucket-Level Access? (Select TWO.)

  1. Access permissions for all objects in the bucket will be evaluated solely based on Cloud IAM policies granted at the bucket or higher resource hierarchy levels.Cevap
  2. Any subsequent operations attempting to set or modify individual object ACLs via gsutil, gcloud, or the GCP Console will be rejected with an authorization error.Cevap
  3. C
    Users must be assigned the primitive Owner role at the project level to view objects inside a bucket after Uniform Bucket-Level Access is enabled.
  4. D
    Removing access permissions at the bucket level will explicitly override and revoke access granted to a user at the parent project level.

Cevap

Enabling Uniform Bucket-Level Access ensures access is governed exclusively through Cloud IAM policies across the resource hierarchy, while disabling object-level ACLs and blocking any attempts to modify object ACLs.
Uniform Bucket-Level Access (UBLA) disables fine-grained object ACLs on a Cloud Storage bucket, ensuring that all access permissions are governed strictly through Cloud IAM policies assigned across the Google Cloud resource hierarchy. Consequently, any request attempting to modify or set per-object ACLs will fail.

Adım Adım Çözüm

1
Analyze the core mechanics of Uniform Bucket-Level Access (UBLA).
UBLA disables legacy Access Control Lists (ACLs) on all objects inside the bucket and enforces Cloud IAM as the sole access control mechanism.
Understanding UBLA requires recognizing that access evaluation transitions fully to bucket-level and higher-level IAM policies.
2
Evaluate the operational restrictions when UBLA is enabled.
Attempts to write, update, or read ACLs on individual objects are blocked and return permission errors.
Cloud Storage enforces API-level constraints preventing fine-grained ACL operations when UBLA is active.
3
Verify resource hierarchy inheritance and least-privilege principles.
IAM permissions are additive down the hierarchy and cannot be negated at lower levels, and predefined roles should be used instead of primitive roles.
GCP IAM policies inherit permissions additively from organization to folder, project, and bucket.

Anahtar Kavram

Uniform Bucket-Level Access (UBLA) disables per-object ACLs and unifies Cloud Storage access control via inherited Cloud IAM permissions.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Configuring Storage Access Controls and Uniform Bucket-Level Access

Bu konudan daha fazla soru