Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
An enterprise organization is designing a security architecture for sensitive datasets stored in Cloud Storage buckets across multiple projects. The security team has defined the following requirements:
Which architectural design should the security engineer implement to satisfy all requirements?
This approach relies on legacy fine-grained Access Control Lists (ACLs) to manage permissions on individual storage objects, configures IAM Conditions at the project resource level, and configures VPC egress firewall rules pointing towards private.googleapis.com.
private.googleapis.com rather than restricted.googleapis.com negates VPC Service Controls protection against insider data exfiltration because private.googleapis.com provides access to Google APIs without enforcing VPC-SC perimeter boundaries.The workload explicitly required legacy multi-tenant object ownership where individual external callers own distinct objects within the same bucket and VPC Service Controls perimeters were not required.
Uniform bucket-level access (UBLA) unifies and simplifies access management by disabling legacy Access Control Lists (ACLs) and requiring all permissions to be granted exclusively via Cloud Identity and Access Management (IAM). VPC Service Controls (VPC-SC) provides perimeter-based security by establishing logical boundaries around Google Cloud resources and APIs, mitigating risks of unauthorized data egress and exfiltration.
resource.name.startsWith()).storage.googleapis.com ensures that requests originating outside authorized access levels or trying to copy data to external, unauthorized buckets are blocked. Routing traffic via DNS to restricted.googleapis.com (199.36.153.4/30) enforces perimeter boundaries and prevents bypasses.This solution provides end-to-end security by combining identity-based governance (UBLA and IAM Conditions) with network-level data loss prevention (VPC Service Controls), satisfying all architectural constraints without introducing unmanageable overhead.
This configuration enables Uniform Bucket-Level Access (UBLA) but uses HMAC keys with signed policy documents to delegate temporary access, and enables standard Private Google Access across internal VPC subnets without establishing a perimeter.
request.time) and resource name prefix filtering natively.The system required legacy S3-compatible API integration where clients outside Google Cloud needed direct, temporary presigned POST access to upload files.
This option attempts to manage temporary access by configuring expiration timestamps within Access Control Lists (ACLs), attaching Principal Access Boundary (PAB) policies, and deploying Cloud Armor security policies to protect Cloud Storage endpoints.
storage.googleapis.com to enforce data service perimeters.The architecture consisted of a custom web application deployed behind an external Application Load Balancer requiring Layer 7 WAF rules, rate limiting, and IP allowlisting.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated