An enterprise organization is designing a security architecture for sensitive datasets stored in Cloud Storage buckets across multiple projects. The security team has defined the following requirements: Eliminate legacy Access Control List (ACL) management so authorization is governed solely and consistently through Cloud IAM. Apply time-delimited access windows and prefix-based path scoping directly on individual bucket policies. Prevent insider data exfiltration and unauthorized external access by establishing a cryptographic and network boundary around Google Cloud Storage APIs. Which architectural design should the security engineer implement to satisfy all requirements?

Enable Uniform Bucket-Level Access on all buckets, configure IAM Conditions directly on bucket-level role bindings, and place the storage projects inside a VPC Service Controls perimeter restricting the Cloud Storage API with DNS routed to restricted.googleapis.com.: ### What Uniform Bucket-Level Access and VPC Service Controls Are **Uniform bucket-level access (UBLA)** unifies and simplifies access management by disabling legacy **Access Control Lists (ACLs)** and requiring all permissions to be granted exclusively via **Cloud Identity and Access Management (IAM)**. **VPC Service Controls (VPC-SC)** provides perimeter-based security by establishing logical boundaries around Google Cloud resources and APIs, mitigating risks of unauthorized data egress and exfiltration. ### How It Meets the Requirements - **Unified IAM governance:** Enabling UBLA on Cloud Storage buckets turns off object-level and bucket-level ACLs. Any request attempting to evaluate or modify ACLs returns an error, ensuring that permissions are governed strictly through centralized IAM policies. - **Direct IAM Conditions on buckets:** Enabling UBLA is a strict prerequisite for applying **IAM Conditions** directly at the bucket level. This allows administrators to enforce dynamic policies, such as granting access only before a specific timestamp or restricting access to specific object name prefixes (e.g., `resource.name.startsWith()`). - **Perimeter defense against exfiltration:** Placing the storage projects inside a **VPC Service Controls service perimeter** and restricting `storage.googleapis.com` ensures that requests originating outside authorized access levels or trying to copy data to external, unauthorized buckets are blocked. Routing traffic via DNS to `restricted.googleapis.com` (`199.36.153.4/30`) enforces perimeter boundaries and prevents bypasses. ### Key Advantages and Capabilities - **Consistent authorization model:** Eliminates administrative drift and permission conflicts between ACLs and IAM policies. - **Temporal and resource scoping:** Enables fine-grained temporary access delegation without generating separate, unmanageable credentials. - **Defense-in-depth perimeter:** Protects against compromised service account keys or insider threats attempting to move data across organizational boundaries. - **Enterprise auditability:** All access decisions and perimeter violations are recorded in **Cloud Audit Logs**. ### Why This Is Optimal This solution provides end-to-end security by combining identity-based governance (UBLA and IAM Conditions) with network-level data loss prevention (VPC Service Controls), satisfying all architectural constraints without introducing unmanageable overhead.

Uniform Bucket Access Iam Conditions Vpc Sc | Professional Cloud Security Engineer

Uniform Bucket Access Iam Conditions Vpc Sc

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization is designing a security architecture for sensitive datasets stored in Cloud Storage buckets across multiple projects. The security team has defined the following requirements:

Eliminate legacy Access Control List (ACL) management so authorization is governed solely and consistently through Cloud IAM.
Apply time-delimited access windows and prefix-based path scoping directly on individual bucket policies.
Prevent insider data exfiltration and unauthorized external access by establishing a cryptographic and network boundary around Google Cloud Storage APIs.

Which architectural design should the security engineer implement to satisfy all requirements?

Configure bucket-level Access Control Lists (ACLs) with expiration timestamps, create principal access boundary policies, and apply Cloud Armor security policies directly to Cloud Storage API endpoints.

Retain fine-grained object ACLs for custom prefix permissions, use IAM condition expressions on project-level IAM bindings, and configure VPC firewall rules blocking public internet IPs while directing traffic to private.googleapis.com.

Enable Uniform Bucket-Level Access on all buckets, configure IAM Conditions directly on bucket-level role bindings, and place the storage projects inside a VPC Service Controls perimeter restricting the Cloud Storage API with DNS routed to restricted.googleapis.com.

Enable Uniform Bucket-Level Access, generate Cloud Storage Signed Policy Documents with temporary HMAC keys for user authorization, and deploy Private Google Access without VPC Service Controls perimeters.

Professional Cloud Security Engineer

Uniform Bucket Access Iam Conditions Vpc Sc

Related questions