An application running on a Compute Engine instance needs to read data from a Cloud Storage bucket. Your team does not allow Cloud Storage buckets to be globally readable and wants to ensure the…

Question

Options

• ACreate a Cloud Storage ACL that allows read-only access from the Compute Engine instance's IP
• BUse a service account with read-only access to the Cloud Storage bucket, and store the
• CUse a service account with read-only access to the Cloud Storage bucket to retrieve the
• DEncrypt the data in the Cloud Storage bucket using Cloud KMS, and allow the application to

• A
  3% (1)
• B
  14% (4)
• C
  76% (22)
• D
  7% (2)

Explanation

Option C is correct because attaching a service account with roles/storage.objectViewer (or a custom read-only role) scoped to the specific bucket to the Compute Engine instance is the GCP-native least-privilege pattern - the instance automatically retrieves short-lived credentials via the metadata server, with no key files to manage or leak.

Why the distractors fail:

• A is wrong because Cloud Storage IAM/ACLs are identity-based, not IP-based; you cannot grant access to an instance's IP address.
• B describes storing a service account key file on the instance or in code, which introduces key management risk and is an anti-pattern GCP explicitly discourages.
• D addresses data encryption at rest (Cloud KMS), not access control - encryption alone does nothing to restrict who can read the bucket.

Memory tip: Think "attach, don't store" - always attach a service account directly to the Compute Engine instance so credentials flow automatically through the metadata server, rather than storing any keys or secrets manually.

No community discussion yet for this question.