GCP Associate Cloud Engineer Practice Question

Your company has a Google Cloud organization with separate "Prod" and "Dev" folders that each contain dozens of projects. Security requires that no Cloud Storage bucket in production can ever be made publicly accessible, while developers may still create public buckets in the Dev folder for testing. As the Associate Cloud Engineer, which approach best meets these requirements with the least operational overhead and without affecting the Dev folder?

Manually enable Uniform bucket-level access and remove public IAM principals on every existing and new bucket in Prod projects.
Create a VPC Service Controls perimeter around all Prod projects to block public access to Cloud Storage.
At the Organization level, add an IAM deny policy that blocks the roles/storage.objectViewer role for the principals allUsers and allAuthenticatedUsers.
Attach the constraints/storage.publicAccessPrevention organization policy to the Prod folder and set it to enforced, leaving the Dev folder without the policy.

Report Issue

Answer Description

The Organization Policy Service lets you set constraints that are inherited by all resources under a resource node (Organization, Folder, or Project). The boolean constraint constraints/storage.publicAccessPrevention prevents any bucket under the targeted node from being made publicly accessible when it is set to enforced: true. By attaching this policy to the Prod folder, every current and future project and bucket inside that folder automatically inherits the restriction, ensuring compliance without per-project configuration. Because the Dev folder is not under this policy, teams there can still create public buckets if needed. Applying the constraint at the Organization level would also block Dev, while configuring IAM or bucket-level settings requires repetitive, error-prone work on every bucket. VPC Service Controls do not address public IAM policies on Cloud Storage.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.