Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
A financial enterprise is deploying an automated transaction processing application on Compute Engine virtual machines (VMs). The application needs to read input batch files from a raw ingestion Cloud Storage bucket and write processed summary outputs to a designated archive bucket.
The security architecture must satisfy the following compliance requirements:
StudyCerts
StudyCertsgrp-fin-admins@example.com) permission to administer bucket configurations and policies without granting full administrative rights across the entire project.Which combination of actions should the cloud architect recommend?
Maintain fine-grained access on both buckets, and use Cloud Storage object ACLs to grant read access on raw files and write access on archive files. Grant the finance administrator group the project-level Editor role.
Enable Uniform Bucket-level Access on both buckets. Download a service account JSON private key, embed it in the VM startup script, and grant the service account the basic Viewer role at the project level.
Enable Uniform Bucket-level Access on both buckets. Create a dedicated user-managed service account attached to the VMs, and grant it predefined Cloud Storage object roles on each bucket. Assign the Storage Admin predefined role to the finance administrator group on the buckets.
Configure fine-grained access with object-level ACLs on both buckets. Use the Compute Engine default service account with the basic Editor role for the VMs, and assign the project-level Owner role to the finance administrator group.
Maintain fine-grained access on both buckets, and use Cloud Storage object ACLs to grant read access on raw files and write access on archive files. Grant the finance administrator group the project-level Editor role.
Enable Uniform Bucket-level Access on both buckets. Download a service account JSON private key, embed it in the VM startup script, and grant the service account the basic Viewer role at the project level.
Enable Uniform Bucket-level Access on both buckets. Create a dedicated user-managed service account attached to the VMs, and grant it predefined Cloud Storage object roles on each bucket. Assign the Storage Admin predefined role to the finance administrator group on the buckets.
Uniform Bucket-level Access disables object-level Access Control Lists (ACLs) across a Cloud Storage bucket, ensuring that access to all objects in the bucket is managed uniformly and exclusively through Google Cloud Identity and Access Management (IAM). Coupling this with user-managed service accounts and predefined IAM roles establishes least-privilege security tailored to application workloads.
roles/storage.objectViewer on the raw data bucket and roles/storage.objectCreator or roles/storage.objectUser on the archive bucket) ensures the VM can only access required resources.roles/storage.admin) to grp-fin-admins@example.com at the bucket or storage level gives them full administrative control over storage resources without exposing project-wide management rights.roles/editor or roles/owner.This solution adheres directly to Google Cloud security best practices by combining IAM-only bucket security with dedicated service accounts and role-based access control, eliminating the maintenance complexity of ACLs while strictly enforcing least privilege.
Configure fine-grained access with object-level ACLs on both buckets. Use the Compute Engine default service account with the basic Editor role for the VMs, and assign the project-level Owner role to the finance administrator group.