Cloud Digital Leader Trust and security with Google Cloud Practice Question
A company's application stores sensitive customer information in Cloud Storage. A security audit finds that one bucket has 'allUsers' access granted (making it publicly accessible on the internet). The security team wants to prevent this from happening in the future. Which control prevents public access from being granted to Cloud Storage buckets?
⚠ Common exam trap
Google Cloud often tests the distinction between preventive, detective, and corrective controls, and the trap here is that candidates confuse VPC Service Controls (which restrict network-level access) with IAM policy controls (which govern identity-based access), leading them to choose option C instead of the correct preventive IAM constraint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply the 'storage.publicAccessPrevention' organization policy constraint, which prevents allUsers and allAuthenticatedUsers from being granted in Cloud Storage IAM policies organization-wide
The 'storage.publicAccessPrevention' organization policy constraint is a Google Cloud IAM constraint that, when enforced at the organization, folder, or project level, prevents any IAM policy binding that grants access to 'allUsers' or 'allAuthenticatedUsers' on Cloud Storage buckets. This is a preventive control that blocks the action before it can occur, directly addressing the security team's requirement to prevent public access from being granted in the future.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Cloud Armor on all Cloud Storage buckets to block public internet access
Why it's wrong here
Cloud Armor is a web application firewall and DDoS mitigation service that attaches to external HTTPS load balancers, where it can enforce IP allow/deny lists, rate limiting, and OWASP-detected signatures. Cloud Storage is not behind an HTTP(S) load balancer by default, and even if you front a bucket with a load balancer, Cloud Armor does not inspect or restrict the bucket's IAM policy, which is where allUsers grants are evaluated. Thus, Cloud Armor would not block public internet access to the bucket's direct endpoints nor prevent a user from applying a public IAM binding.
- ✓
Apply the 'storage.publicAccessPrevention' organization policy constraint, which prevents allUsers and allAuthenticatedUsers from being granted in Cloud Storage IAM policies organization-wide
Why this is correct
Public Access Prevention is the correct control. Applied as an org policy, it makes it impossible to grant allUsers or allAuthenticatedUsers access to any bucket in the organization. Attempts to set such policies are rejected by the API. This is the definitive preventive control for accidental public bucket exposure.
- ✗
Enable VPC Service Controls around Cloud Storage to prevent public internet access
Why it's wrong here
VPC Service Controls restrict access from outside the defined perimeter but don't specifically address allUsers IAM bindings. They are primarily for preventing data exfiltration to other GCP projects, not for managing public internet accessibility of specific resources.
- ✗
Configure Cloud Monitoring to alert the security team when a bucket is made public so they can revert it
Why it's wrong here
Cloud Monitoring can ingest audit logs and custom metrics, so it is possible to create an alert when a bucket's IAM policy changes to include allUsers or allAuthenticatedUsers; however, this is a detective control that only notifies the security team after the change has already taken effect. Because the bucket is already publicly accessible in the interval between the grant and the human response, it does not prevent the exposure or meet the stated requirement to block future incidents. Prevention requires a policy-level guardrail such as the storage.publicAccessPrevention organization policy, not an alerting mechanism.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Preventive control
A preventive control is a security measure designed to stop unauthorized access, attacks, or errors before they can occur.
Key term
IAM policy
An IAM policy is a set of rules that determines who can access specific cloud resources and what actions they are allowed to perform.
About these practice questions
Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.