CLOUD-DIGITAL-LEADER · Question #7
Your organization needs to restrict access to a Cloud Storage bucket. Only employees who are based in Canada should be allowed to view the contents. What is the most effective and efficient way to…
The correct answer is D. Create a group consisting of all Canada-based employees, and give the group access to the. Using a Google Group (or Cloud Identity group) to manage access is the most efficient and scalable IAM best practice. You grant the permission once to the group, and membership changes (new hires, departures, relocations) are managed by updating the group - not by modifying…
Question
Your organization needs to restrict access to a Cloud Storage bucket. Only employees who are based in Canada should be allowed to view the contents. What is the most effective and efficient way to satisfy this requirement?
Options
- ADeploy the Cloud Storage bucket to a Google Cloud region in Canada
- BConfigure Google Cloud Armor to allow access to the bucket only from IP addresses based in
- CGive each employee who is based in Canada access to the bucket
- DCreate a group consisting of all Canada-based employees, and give the group access to the
How the community answered
(50 responses)- A6% (3)
- B22% (11)
- C10% (5)
- D62% (31)
Explanation
Using a Google Group (or Cloud Identity group) to manage access is the most efficient and scalable IAM best practice. You grant the permission once to the group, and membership changes (new hires, departures, relocations) are managed by updating the group - not by modifying bucket permissions. Deploying the bucket to a Canadian region (A) controls data residency, not access. Cloud Armor (B) enforces access based on IP geolocation, which is less reliable than identity-based access and adds operational complexity. Granting access per individual employee (C) is tedious and error-prone at scale.
Topics
Community Discussion
No community discussion yet for this question.