Cloud Digital Leader Google Cloud Products and Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure Cloud Armor with IP allowlist

  Why it's wrong here

  Cloud Armor is a web application firewall (WAF) that protects HTTP(S) load-balanced applications by filtering traffic based on rules like IP allowlists or OWASP signatures. However, Cloud Storage buckets are not fronted by HTTP(S) load balancers; they are accessed via the Cloud Storage API or the googleapis.com endpoint. Therefore, Cloud Armor cannot restrict access to Cloud Storage buckets, making this option ineffective for securing stored sensitive data.

• ✗

  Enable VPC Service Controls

  Why it's wrong here

  VPC Service Controls enables you to build a security perimeter around Google Cloud services, restricting data access based on the originating VPC network, project, or client identity. It helps prevent data exfiltration but does not support IP address conditions; it evaluates context such as the requesting service or network, not the specific source IP. For restricting access to a bucket from a corporate IP range, VPC Service Controls alone is insufficient—it complements but does not replace IP-based IAM conditions.

• ✓

  Set a bucket policy with an IP address condition

  Why this is correct

  You can apply an IAM condition to a Cloud Storage bucket policy to restrict access based on the requester's source IP address. For example, setting a condition like `request.sourceIp.startsWith("203.0.113.")` ensures only requests originating from your corporate IP range can read or write objects. This is a valid and direct method to enforce network-level access control for sensitive data in Cloud Storage, making it a correct alternative to CMEK.

• ✗

  Configure Cloud NAT

  Why it's wrong here

  Cloud NAT provides source network address translation for private Compute Engine instances so they can reach the internet without external IP addresses. It is a data-plane gateway that enables outbound communication, not an access control mechanism for inbound requests to Cloud Storage. Configuring Cloud NAT does not restrict who can access your bucket, nor does it affect encryption or IAM policies, so it has no bearing on securing sensitive data at rest.

• ✓

  Use Cloud KMS to create and manage a key for CMEK

  Why this is correct

  Cloud KMS enables you to create, manage, and rotate your own encryption keys. When you use a customer-managed encryption key (CMEK) with Cloud Storage, the data in your bucket is encrypted under a key you control, rather than Google's default encryption. This provides the control and auditability needed for sensitive data, allowing you to set key lifecycle policies and revoke the key if necessary. This is the correct approach for meeting encryption key management requirements.

Go deeper

Related to this question