Question 220
A data team uses a Cloud Storage bucket with mixed object-level ACLs and IAM policies, making access audits inconsistent. Which limitation must be considered before claiming the issue is fully resolved?
Explanation
Correct Answer
Uniform access may break applications relying on object ACL semantics. This caution prevents extrapolating beyond the specific evidence or product boundary. Object permission migration requires testing old application access patterns. The unresolved point should be tested using bucket uniform-access setting, IAM bindings and object access traces rather than assuming a working interface proves full compliance or resilience.
Incorrect Answers
Uniform bucket-level access preserves every application-specific ACL operation unchanged. This limitation is framed as a blanket exception, but the case requires a different, narrower caution. The relevant boundary is that uniform access may break applications relying on object ACL semantics. Object permission migration requires testing old application access patterns. Inspect bucket uniform-access setting, IAM bindings and object access traces.
A policy set marked Uniform guarantees that every object has no public risk. The proposed claim mistakes an incomplete signal or product feature for a universal guarantee. The relevant boundary is that uniform access may break applications relying on object ACL semantics. Object permission migration requires testing old application access patterns. Inspect bucket uniform-access setting, IAM bindings and object access traces.
A publicly accessible object is safe because its bucket has a restrictive label. This claim exceeds the evidence and ignores an important risk or operational dependency. The relevant boundary is that uniform access may break applications relying on object ACL semantics. Object permission migration requires testing old application access patterns. Inspect bucket uniform-access setting, IAM bindings and object access traces.