Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ262

Ensuring data protection

You need to enforce a security policy in your Google Cloud organization that prevents users from exposing objects in their buckets externally. There are currently no buckets in the organization. Which solution should you proactively implement to meet this goal with the least operational overhead?

  • A Create an hourly cron job to run a Cloud Function that finds public buckets and makes them private.
  • B Enable the constraints/storage.publicAccessPrevention constraint at the organization level.
  • C Enable the constraints/storage.uniformBucketLevelAccess constraint at the organization level.
  • D Create a VPC Service Controls perimeter that protects the storage.googleapis.com service in your projects that contains buckets. Add any new project that contains a bucket to the perimeter.
Explanation

Enforcing constraints/storage.publicAccessPrevention at the organization level restricts public access for all new and existing Cloud Storage buckets and objects beneath that resource. It blocks grants to public principals through IAM policies or ACLs, providing centralized, preventive enforcement without per-bucket management or remediation automation.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!