Question 15

Explanation

Option B is CORRECT. Access Control Lists (ACLs) provide the most granular control by allowing permissions to be specified on individual objects within a bucket. With ACLs, different permissions can be assigned to different users for specific objects, enabling fine-grained access patterns where certain objects in a bucket have different access requirements than others. This level of per-object permission control isn't possible with the other options.

Option A is INCORRECT. Uniform bucket-level access applies permissions at the bucket level and disables ACLs, removing the ability to set different permissions on individual objects. While this creates a more consistent permissions model aligned with IAM, it sacrifices the granular, object-level control that ACLs provide.

Option C is INCORRECT. IAM conditions allow for dynamic access based on attributes like time, resource attributes, or request properties, but they still apply at the bucket level when used with uniform bucket-level access. They don't provide the ability to set different permissions for individual objects independent of conditions.

Option D is INCORRECT. Signed URLs provide time-limited access to specific objects but don't represent a comprehensive access control method. They're useful for granting temporary access without requiring Google accounts but don't provide the persistent, user-specific permission controls that ACLs offer for day-to-day access management.