Google Professional Cloud Security Engineer Question 315
Select 2Google Cloud PlatformYou are a security engineer managing a Google Cloud environment with several Compute Engine instances. To prevent unauthorized access to sensitive metadata and reduce potential attack vectors, which of the following actions should you take?
- A
Disable the default service account assigned to the Compute Engine instances.
- B
Enable the metadata concealment feature to block unauthorized access to the metadata server.
- C
Restrict access to the metadata server by configuring a custom firewall rule.
- D
Use the
--no-service-accountand--no-scopesflags when creating Compute Engine instances. - E
Upgrade the metadata server to the latest version to patch potential vulnerabilities.
Show answer and explanation
Correct answers: B, D
Explanation
To protect and manage Compute Engine instance metadata, enabling the metadata concealment feature helps prevent unauthorized access to sensitive metadata, such as tokens. Additionally, using the --no-service-account and --no-scopes flags during instance creation ensures that no unnecessary permissions are assigned to the instance, minimizing the attack surface.
- A. Incorrect.
Disabling the default service account is not recommended as it could break applications relying on this service account for API access. Instead, you should assign appropriate roles and scopes.
- B. Correct.
Enabling the metadata concealment feature is a best practice for protecting sensitive metadata, such as access tokens, from unauthorized access or exploitation.
- C. Incorrect.
Custom firewall rules do not restrict access to the metadata server, as it is internally accessible from the instance itself. This option does not address the concern.
- D. Correct.
Using the
--no-service-accountand--no-scopesflags when creating instances ensures no service account or unnecessary permissions are assigned to the instance, reducing the attack surface. - E. Incorrect.
Upgrading the metadata server is not a user-configurable action in Google Cloud. Metadata server management is handled by Google Cloud, so this option is incorrect.