Google Professional Cloud Security Engineer

Google Professional Cloud Security Engineer · free preview Question 1 of 8

A security engineer must grant a service account permission to read objects from a single Cloud Storage bucket without granting project-wide access. What is the most appropriate approach?

Grant the Storage Object Viewer role on the specific bucket via a bucket-level IAM policy

Grant the Storage Admin role at the project level

Add the service account to the project Owner role

Make the bucket public and restrict by IP