Google Professional Cloud Security Engineer Question 313
Select 2Google Cloud PlatformYou are a security engineer managing a Google Cloud project. To prevent unauthorized access to sensitive instance metadata, you want to ensure the highest level of security for your Compute Engine instances. Which actions should you take?
- A
Enable the 'block-project-wide-ssh-keys' setting on the instance.
- B
Set the 'metadata concealment' feature by enabling the GKE Metadata Server for Kubernetes clusters.
- C
Disable the default 'allow-HTTP-access-to-metadata' option in the Compute Engine instance settings.
- D
Restrict metadata server access by setting up a metadata query firewall rule in your VPC.
- E
Use service account scopes to grant your Compute Engine instance access to necessary resources.
Show answer and explanation
Correct answers: B, D
Explanation
Instance metadata contains sensitive information, such as access tokens and configuration details, which can be exploited if not properly secured. Enabling the GKE Metadata Server (option 2) for Kubernetes clusters conceals metadata and prevents direct access by workloads. Additionally, setting up metadata query firewall rules (option 4) ensures that access to the metadata server is restricted to authorized sources, reducing the risk of unauthorized access.
- A. Incorrect.
This option is unrelated to metadata protection. The 'block-project-wide-ssh-keys' setting is used to control SSH access to instances, not metadata security.
- B. Correct.
This is correct because enabling the GKE Metadata Server ensures that metadata is concealed and prevents direct access to instance metadata from the workloads running in Kubernetes clusters.
- C. Incorrect.
This is incorrect because there is no default option to disable HTTP access to the metadata server in Compute Engine. Access to metadata is always through HTTP, but it can be controlled by other means.
- D. Correct.
This is correct because restricting access to the metadata server using a metadata query firewall rule limits which IP ranges or VMs can query instance metadata, helping protect sensitive information.
- E. Incorrect.
This is incorrect because service account scopes are used to define resource access permissions for the instance itself, but they do not directly secure or protect metadata from unauthorized access.