Google Professional Cloud Security Engineer
Get started today
Ultimate access to all questions.
Comments
Loading comments...
Ultimate access to all questions.
An application running on a Compute Engine instance needs to access data in a Cloud Storage bucket. Your team's policy prohibits globally readable buckets and requires adherence to the principle of least privilege.
Which is the correct approach to meet this requirement?
A
Create a Cloud Storage ACL that allows read-only access from the Compute Engine instance's IP address and allows the application to read from the bucket without credentials.
B
Use a service account with read-only access to the Cloud Storage bucket, and store the credentials to the service account in the config of the application on the Compute Engine instance.
C
Use a service account with read-only access to the Cloud Storage bucket to retrieve the credentials from the instance metadata.
D
Encrypt the data in the Cloud Storage bucket using Cloud KMS, and allow the application to decrypt the data with the KMS key.