Cloud Digital Leader Trust and security with Google Cloud Practice Question
A company stores sensitive customer data in Cloud Storage buckets. The security team wants to ensure that only authorized users can access the data, and access is logged for audit. Which two practices should they implement? (Choose two.)
⚠ Common exam trap
Google Cloud often tests the distinction between data protection (encryption) and access control (IAM), leading candidates to mistakenly choose encryption options like CMEK when the question asks about restricting access and logging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply IAM conditions to restrict access based on user attributes like IP address or time of day.
IAM conditions allow fine-grained, attribute-based access control, such as restricting access to Cloud Storage buckets based on the requester's IP address or time of day, ensuring only authorized users can access the data under specific contexts. Option C is correct because Cloud Audit Logs record all access attempts (including successful and denied requests) to the bucket, providing the necessary audit trail for security and compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Storage Transfer Service to replicate data to a secured bucket.
Why it's wrong here
Storage Transfer Service is designed to move or replicate objects between buckets, from on-premises, or from other clouds. Replicating customer data to a 'secured' bucket does not impose any new restrictions on who may access the original bucket, nor does it generate audit records for those access attempts. It changes the data's location, not the identity- or attribute-based authorization policy that determines access. Therefore, while it may support resilience, it is not a security control for restricting access.
- ✓
Apply IAM conditions to restrict access based on user attributes like IP address or time of day.
Why this is correct
IAM conditions allow you to bind an IAM role with a condition expression based on attributes such as source IP, date/time, or resource tags. For instance, you can grant the Storage Object Viewer role only for requests coming from a corporate CIDR block and during business hours. This directly enforces attribute-based access control on the bucket, limiting who can read or write sensitive customer data. It is the appropriate method for restricting access at the user and request level.
- ✓
Use Cloud Audit Logs to record all access attempts.
Why this is correct
Cloud Audit Logs capture Admin Activity and, when explicitly enabled, Data Access audit logs for Cloud Storage. These logs record who performed an action, what action was taken, what resource was accessed, and the originating IP address at a given timestamp. This gives you a detective record of all successful and failed access attempts for compliance investigations or security monitoring. It does not by itself stop unauthorized access, but it provides the audit trail needed to detect and respond to incidents.
- ✗
Set up Private Google Access to restrict access to the bucket.
Why it's wrong here
Private Google Access is a network configuration that allows VM instances without an external IP address, or on-premises hosts using Cloud Interconnect, to reach Google APIs and Cloud Storage through internal or private IPs. It changes the network path used to access a bucket, but it does not authenticate individual users or enforce bucket-level permissions. Any IAM permission granted to a user is still honored over this private connection, so it cannot 'restrict access' in the sense of blocking specific people or conditions. It also produces no access logs for user actions.
- ✗
Enable default encryption on all buckets using CMEK.
Why it's wrong here
Default encryption with Cloud KMS CMEK encrypts all data at rest in the bucket using a customer-managed key, protecting against physical exfiltration and meeting key-management compliance requirements. However, encryption is a confidentiality control independent of authorization: a user with Storage Object Viewer or Admin permission can still list and read cleartext data regardless of which key was used for encryption. It does not restrict who attempts access, does not create audit logs of access events, and does not enforce time/IP conditions. Encryption and access control are complementary layers, not substitutes.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.