An Application Running on a Compute Engine Instance Needs to Read

question 31

Multiple Choice

An application running on a Compute Engine instance needs to read data from a Cloud Storage bucket. Your team does not allow Cloud Storage buckets to be globally readable and wants to ensure the principle of least privilege. Which option meets the requirement of your team?

• A) Create a Cloud Storage ACL that allows read-only access from the Compute Engine instance's IP address and allows the application to read from the bucket without credentials.
• B) Use a service account with read-only access to the Cloud Storage bucket, and store the credentials to the service account in the config of the application on the Compute Engine instance.
• C) Use a service account with read-only access to the Cloud Storage bucket to retrieve the credentials from the instance metadata.
• D) Encrypt the data in the Cloud Storage bucket using Cloud KMS, and allow the application to decrypt the data with the KMS key.

---

Definitions:

Individual Investors

Private investors who buy and sell securities for their personal account, and not for another company or organization.

Separate Basis

In tax accounting, the calculation of gain or loss on each asset individually rather than on a combined basis.

Professional Management

The aspect of mutual funds and investment portfolios where experienced managers make investment decisions on behalf of investors, aiming to achieve the best returns possible.

Record Keeping

The systematic process of maintaining and organizing records or documents related to transactions or operations.