Google Professional Cloud Security Engineer Question 314
Select 3Google Cloud PlatformYou are a security engineer tasked with securing the metadata of Compute Engine instances in your Google Cloud environment. You need to ensure that only authorized applications running on the instance can access the metadata server and prevent potential metadata exposure through unauthorized access. Which of the following actions should you take?
- A
Restrict access to the metadata server by setting up a firewall rule to block external IP addresses.
- B
Use a service account with minimal permissions assigned to the VM instance.
- C
Disable the legacy metadata server endpoints (0.1 and v1beta1).
- D
Restrict metadata server access by configuring a metadata query whitelist.
- E
Use IAM roles to control access to metadata server endpoints.
Show answer and explanation
Correct answers: B, C, E
Explanation
To protect and manage Compute Engine instance metadata, it is important to follow best practices such as using service accounts with minimal permissions, disabling legacy metadata server endpoints, and leveraging IAM roles to restrict access. These measures collectively reduce the risk of unauthorized access to sensitive metadata or privilege escalation attacks.
- A. Incorrect.
Incorrect. The metadata server is accessed over the internal network (169.254.169.254), so firewall rules cannot block access to it.
- B. Correct.
Correct. Assigning a service account with minimal permissions to the VM instance prevents unnecessary access to resources and limits the impact if the metadata server is exploited.
- C. Correct.
Correct. Disabling legacy metadata server endpoints reduces the attack surface by forcing all metadata queries to use the latest, more secure endpoints.
- D. Incorrect.
Incorrect. Google Cloud does not provide a built-in mechanism for configuring a metadata query whitelist. Metadata access is controlled through other measures like service accounts and IAM.
- E. Correct.
Correct. IAM roles can be used to control access to the metadata server, ensuring that only authorized identities can access specific metadata information.