Google Professional Cloud Security Engineer Question 311
Select 2Google Cloud PlatformYou are responsible for securing the metadata of your Compute Engine instances in a project. A developer has accidentally exposed a sensitive API key by reading metadata using http://metadata.google.internal, and you need to implement measures to prevent unauthorized access to sensitive metadata while still allowing legitimate applications to function. Which of the following actions should you take to protect the metadata?
- A
Disable legacy metadata server endpoints and enforce the use of the metadata flavor header.
- B
Use a service account with only the necessary permissions instead of hardcoding sensitive API keys in the application.
- C
Restrict access to the metadata server by configuring a firewall rule to block external access.
- D
Enable the Shielded VM feature to encrypt metadata requests between the instance and the metadata server.
- E
Implement metadata concealment by turning off metadata queries entirely using IAM policies.
Show answer and explanation
Correct answers: A, B
Explanation
To protect and manage instance metadata, it is critical to enforce security measures such as disabling legacy endpoints, requiring the metadata flavor header, and using service accounts with minimal permissions rather than hardcoding sensitive data. These actions effectively minimize the risk of metadata exposure while ensuring legitimate functionality. Blocking external access or disabling metadata entirely are either unnecessary or infeasible.
- A. Correct.
Disabling legacy metadata server endpoints and enforcing the use of the metadata flavor header improves metadata security by ensuring that only authorized requests can access metadata. This prevents unauthorized access to sensitive information.
- B. Correct.
Using a service account with only the necessary permissions eliminates the need for exposing sensitive API keys in the metadata or application code, reducing the risk of accidental leaks.
- C. Incorrect.
Metadata servers are only accessible from within the instance by design. Configuring a firewall rule to block external access is not applicable as the metadata server does not accept external traffic.
- D. Incorrect.
While enabling Shielded VM improves the overall security of the virtual machine, it does not specifically address or encrypt metadata requests to the metadata server.
- E. Incorrect.
There is no feature in Google Cloud that allows metadata queries to be completely turned off using IAM policies. Metadata is essential for instance operations and cannot be entirely disabled.