You work for an organization that handles sensitive customer data. You must secure a series of Google Cloud Storage buckets housing this data and meet these requirements: - Multiple teams need…

Question

Options

• ACreate IAM groups for each team and manage permissions at the group level. Employ server-
• BSet individual permissions for each team and apply access control lists (ACLs) to each bucket
• CUse predefined IAM roles tailored to each team's access needs, such as Storage Object Viewer
• DAssign IAM permissions for all teams at the object level. Implement third-party software to encrypt

• A
  4% (1)
• B
  7% (2)
• C
  79% (22)
• D
  11% (3)

Explanation

Option C satisfies all four requirements. Predefined IAM roles like Storage Object Viewer (read-only) and Storage Object Admin or Storage Object Creator (read-write) provide granular, team-level access control via IAM groups - meeting the varying access level requirement. Customer-Managed Encryption Keys (CMEK) via Cloud KMS give the organization control over encryption keys - meeting the compliance requirement. Cloud Audit Logs track all access and file change events - meeting the audit and compliance tracking requirement. Data at rest in Cloud Storage is automatically encrypted (and CMEK adds organizational key control). Option A is vague about key management. Option B relies on legacy ACLs, which are less manageable than IAM at scale. Option D uses object-level permissions (overly granular) and third-party encryption (loses native GCP integration and auditability).

No community discussion yet for this question.