Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An enterprise security engineer is auditing legacy Google Cloud Storage buckets that contain sensitive data. Currently, access to files within the buckets is governed by a combination of legacy Object Access Control Lists (ACLs) and Cloud IAM role bindings. The security team mandates that object-level ACLs must be eliminated in favor of centralized IAM policy enforcement to prevent permission drift and simplify compliance auditing.
Which strategy should the security engineer implement to transition the buckets to Uniform Bucket-Level Access (UBLA) without disrupting access for authorized users?
Enable Cloud Storage Bucket Lock with a retention policy to automatically convert existing object-level ACLs into bucket IAM policies.
Modify individual object metadata to apply the roles/storage.legacyObjectOwner IAM role directly to objects, and then enforce an Organization Policy constraint across the project.
Analyze existing ACL usage via Cloud Audit Logs, grant equivalent IAM roles (such as Storage Object Viewer or Storage Object Admin) at the bucket level to authorized principals, and enable Uniform Bucket-Level Access on the bucket.
Reset bucket ACLs to private using legacy gsutil/gcloud commands, assign Storage Admin roles at the project level, and re-upload all objects to clear legacy ACL entries.
Enable Cloud Storage Bucket Lock with a retention policy to automatically convert existing object-level ACLs into bucket IAM policies.
Modify individual object metadata to apply the roles/storage.legacyObjectOwner IAM role directly to objects, and then enforce an Organization Policy constraint across the project.
Analyze existing ACL usage via Cloud Audit Logs, grant equivalent IAM roles (such as Storage Object Viewer or Storage Object Admin) at the bucket level to authorized principals, and enable Uniform Bucket-Level Access on the bucket.
Uniform Bucket-Level Access (UBLA) is a Cloud Storage security feature that unifies and simplifies access management by enforcing permissions exclusively through Identity and Access Management (IAM). When UBLA is enabled on a bucket, Cloud Storage ignores all existing object-level and bucket-level Access Control Lists (ACLs), ensuring that access is granted solely through IAM policies defined at the bucket, folder, project, or organization level.
StudyCerts
StudyCertsroles/storage.objectViewer) or Storage Object Admin (roles/storage.objectAdmin)—at the bucket level ensures legitimate users retain required read/write permissions.This approach follows Google Cloud best practices for IAM migration. It proactively maps out legacy access patterns, grants appropriate least-privilege IAM roles at the bucket resource level, and cleanly deactivates object-level ACL parsing by enabling UBLA.
Reset bucket ACLs to private using legacy gsutil/gcloud commands, assign Storage Admin roles at the project level, and re-upload all objects to clear legacy ACL entries.