PROFESSIONAL-CLOUD-DEVELOPER · Question #328
You are developing a secure document sharing platform. The platform allows users to share documents with other users who may be external to their organization. Access to these documents should be…
The correct answer is C. Generate a signed URL for each document the user wants to share. Signed URLs are the correct mechanism for granting time-limited, per-object access to Cloud Storage. When generating a signed URL you specify an expiration time (the 'configurable time period'), after which the URL becomes invalid and access is automatically revoked - no manual…
Question
You are developing a secure document sharing platform. The platform allows users to share documents with other users who may be external to their organization. Access to these documents should be revoked after a configurable time period. The documents are stored in Cloud Storage. How should you configure Cloud Storage to support this functionality?
Options
- ACreate signed policy documents on the Cloud Storage bucket.
- BApply access control list (ACL) permissions to the Cloud Storage bucket.
- CGenerate a signed URL for each document the user wants to share.
- DGrant the Storage Object Viewer IAM role to all authenticated users.
How the community answered
(24 responses)- A4% (1)
- B17% (4)
- C71% (17)
- D8% (2)
Explanation
Signed URLs are the correct mechanism for granting time-limited, per-object access to Cloud Storage. When generating a signed URL you specify an expiration time (the 'configurable time period'), after which the URL becomes invalid and access is automatically revoked - no manual cleanup required. Option A (signed policy documents) governs upload conditions for HTML forms, not download access control. Option B (ACL permissions) are persistent - there is no built-in expiry, so revoking access requires an explicit API call. Option D (Storage Object Viewer to all authenticated users) grants permanent, broad access with no time limit and no per-user control.
Topics
Community Discussion
No community discussion yet for this question.