Google Exam Professional Cloud Security Engineer Topic 4 Question 5 Discussion

Actual exam question for Google's Professional Cloud Security Engineer exam

Question #: 5
Topic #: 4

[All Professional Cloud Security Engineer Questions]

An application running on a Compute Engine instance needs to read data from a Cloud Storage bucket. Your team does not allow Cloud Storage buckets to be globally readable and wants to ensure the principle of least privilege.

Which option meets the requirement of your team?

ACreate a Cloud Storage ACL that allows read-only access from the Compute Engine instance's IP address and allows the application to read from the bucket without credentials.

BUse a service account with read-only access to the Cloud Storage bucket, and store the credentials to the service account in the config of the application on the Compute Engine instance.

CUse a service account with read-only access to the Cloud Storage bucket to retrieve the credentials from the instance metadata.

DEncrypt the data in the Cloud Storage bucket using Cloud KMS, and allow the application to decrypt the data with the KMS key.

Show Suggested Answer

Suggested Answer: C

by Latrice at May 06, 2022, 04:40 AM

Limited Time Offer

25%

Off

Get Premium Professional Cloud Security Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!