Google Associate Cloud Engineer Question 347
Select 4Google Cloud PlatformYou are tasked with setting up a new application in Google Cloud Platform (GCP) that requires access to multiple GCP services including Google Cloud Storage and Google Cloud Pub/Sub. To ensure security best practices, you decide to use a service account for this purpose. Which of the following steps must you take to correctly create and configure a service account for the application?
- A
Create a new service account in the Google Cloud Console.
- B
Assign the service account the 'Viewer' role to access all necessary GCP services.
- C
Generate a new key pair for the service account and download the private key.
- D
Assign only the necessary IAM roles to the service account to follow the principle of least privilege.
- E
Enable the required APIs for the services that the application will access.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
To securely create and configure a service account for an application in GCP, it is important to follow a series of steps that adhere to security best practices. This includes creating a service account, generating credentials, assigning roles that grant only the permissions necessary for the application's function (principle of least privilege), and ensuring that the APIs required by the application are enabled. This approach minimizes potential security risks while ensuring the application has the necessary access.
- A. Correct.
Creating a new service account in the Google Cloud Console is the first step in setting up a service account.
- B. Incorrect.
Assigning the 'Viewer' role is not appropriate here as it provides read-only access to all resources, which might not be necessary and violates the principle of least privilege.
- C. Correct.
Generating a key pair and downloading the private key is necessary if the application needs to authenticate using the service account.
- D. Correct.
Assigning only the necessary IAM roles helps maintain security by granting minimal required permissions.
- E. Correct.
Enabling the required APIs is necessary for the application to interact with the respective GCP services.