Google Cloud Professional Cloud Security Engineer Practice Exam

To avoid giving the uploader of an object full control while managing bucket access, what should be enabled?

1. Fine-grained access control

2. Bucket ownership changes

3. Uniform bucket-level access

4. Audit logging

The correct answer is: Uniform bucket-level access

Enabling uniform bucket-level access is the suitable choice for maintaining control over object uploads while preventing the uploader from having full control over the object in a Google Cloud Storage bucket. With uniform bucket-level access, the access control is simplified by applying uniform permissions across all objects within the bucket, rather than having individual object-level permissions that might inadvertently grant too much access to the uploader. By utilizing this approach, you can ensure that permissions are consistently applied at the bucket level, meaning that the privileges associated with the bucket will govern access to all the objects stored within it. This configuration effectively limits what the uploader can do with the object, reducing the risk of unauthorized changes or access to the data. In contrast, fine-grained access control allows for more detailed permissions at the object level, which could potentially give the uploader more control than intended. Bucket ownership changes, while useful for transferring ownership, don't specifically address the need to manage access control during uploads. Audit logging is beneficial for tracking access and changes but does not inherently manage or restrict access controls for uploaded objects.