Examkin

Soru

Zorluk: ZorDeploying and Configuring Cloud Storage Buckets and Objects

A cloud security administrator needs to deploy a new Google Cloud Storage bucket named `gs://secure-partner-intake-data` in the `us-central1` region. Corporate security compliance mandates two strict technical controls upon resource deployment: all uploaded objects must be automatically encrypted using an existing Customer-Managed Encryption Key (CMEK) path (`projects/corp-sec-kms/locations/global/keyRings/finance-kr/cryptoKeys/intake-key`), and Uniform Bucket-Level Access must be enabled immediately to prevent object-level ACL assignments. Which single `gcloud` command correctly provisions this bucket meeting all compliance requirements?

  1. gcloud storage buckets create gs://secure-partner-intake-data --location=us-central1 --default-key=projects/corp-sec-kms/locations/global/keyRings/finance-kr/cryptoKeys/intake-key --uniform-bucket-level-accessCevap
  2. B
    gcloud compute buckets create gs://secure-partner-intake-data --zone=us-central1-a --default-kms-key=projects/corp-sec-kms/locations/global/keyRings/finance-kr/cryptoKeys/intake-key
  3. C
    gsutil mb -l us-central1 -k projects/corp-sec-kms/locations/global/keyRings/finance-kr/cryptoKeys/intake-key gs://secure-partner-intake-data && gsutil acl set private gs://secure-partner-intake-data
  4. D
    gcloud storage buckets create gs://secure-partner-intake-data --location=us-central1 --pap=enforced && gcloud storage buckets add-iam-policy-binding gs://secure-partner-intake-data --member=allUsers --role=roles/owner

Cevap

The correct command is `gcloud storage buckets create gs://secure-partner-intake-data --location=us-central1 --default-key=projects/corp-sec-kms/locations/global/keyRings/finance-kr/cryptoKeys/intake-key --uniform-bucket-level-access`.
The command starting with `gcloud storage buckets create` correctly uses `--location=us-central1` for region placement, `--default-key` to specify the Cloud KMS key for CMEK encryption of incoming objects, and `--uniform-bucket-level-access` to enforce uniform IAM policy evaluation across all objects in the bucket.

Adım Adım Çözüm

1
Identify the primary CLI component for Google Cloud Storage management.
The current standard command component is `gcloud storage buckets create`.
Google Cloud CLI `gcloud storage` subcommands supersede legacy tools and provide unified management for buckets and objects.
2
Select the proper flag for Customer-Managed Encryption Keys (CMEK).
The correct flag is `--default-key=` followed by the fully qualified Cloud KMS key resource ID.
This ensures all new objects uploaded to the bucket are encrypted with the specified KMS key automatically.
3
Specify uniform access control during bucket creation.
Include the `--uniform-bucket-level-access` flag in the creation command.
Enabling Uniform Bucket-Level Access disables ACLs and unifies permission management exclusively through Cloud IAM roles.

Anahtar Kavram

Deploying Cloud Storage Buckets with CMEK Encryption and Uniform Bucket-Level Access via gcloud CLI
Bu soruyu puanla

Konular

Deploying and Configuring Cloud Storage Buckets and Objects