4.1 Configure Access Control and Governance ASSOCIATE-DATA-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A service account needs to upload new objects to a Cloud Storage bucket but should not be able to delete or overwrite existing objects. Which role should be granted?

   • Aroles/storage.objectCreator
   • Broles/storage.objectViewer
   • Croles/storage.admin
   • Droles/storage.objectAdmin
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A new data analyst joins the team and needs to run BigQuery queries that read from a specific dataset. The analyst should not be able to create or delete tables. The organization uses predefined roles to enforce least privilege. What is the most appropriate role to assign?

   • ABigQuery Job User on the project
   • BProject Viewer on the project
   • CBigQuery Data Editor on the dataset
   • DBigQuery Data Viewer on the dataset
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which access control method for Cloud Storage is recommended for most use cases because it simplifies permission management and reduces the risk of misconfigured access?

   • AUniform access control
   • BPublic access control
   • CFine-grained access control
   • DPrivate access control
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company has a Cloud Storage bucket with uniform bucket-level access. They want to allow a third-party service account to write objects to the bucket, but the service account should not be able to read or delete objects. The company also wants to ensure that the service account cannot list objects. What is the most appropriate IAM role?

   • AStorage Object Admin on the bucket
   • BStorage Legacy Bucket Writer on the bucket
   • CStorage Object Creator on the bucket
   • DStorage Object Viewer on the bucket
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is a primary benefit of using Analytics Hub for data sharing compared to manually granting IAM roles to external users?

   • AIt allows sharing of any type of data, including unstructured files, without additional configuration.
   • BIt automatically replicates data to the consumer's project to avoid any network latency.
   • CIt provides a centralized marketplace for discovering and subscribing to shared data assets.
   • DIt eliminates the need for any access control because data is public by default.
   Reveal Solution Discussion Select an answer first