Google Professional Cloud Security Engineer Question 316
Select 3Google Cloud PlatformYou are configuring a Compute Engine instance in Google Cloud and want to ensure that the instance's metadata is protected from unauthorized access. Which of the following actions should you take to improve metadata security for the instance?
- A
Disable the legacy metadata server endpoint and require the use of the GCE metadata server v1 endpoint.
- B
Restrict access to the metadata server by using firewall rules.
- C
Enable metadata concealment by configuring the Instance Metadata Server to only allow requests from the local instance.
- D
Set the 'metadata-flavor' header to 'Google' for all authorized API requests.
- E
Use IAM roles and service accounts to minimize the permissions granted to applications running on the instance.
Show answer and explanation
Correct answers: C, D, E
Explanation
Protecting and managing Compute Engine instance metadata is critical for maintaining the security of your cloud environment. Metadata servers provide sensitive information, such as service account credentials and custom metadata, which must be secured. By enabling metadata concealment, requiring the 'metadata-flavor' header, and enforcing least privilege through IAM roles and service accounts, you can significantly reduce the risk of unauthorized access and misuse of metadata. External firewall rules do not apply to metadata servers, and disabling metadata endpoints is not a valid approach.
- A. Incorrect.
This option is incorrect because disabling the legacy metadata server endpoint is not a recommended or valid approach. Google Cloud does not support disabling the metadata server itself, but you can take other precautions to secure it.
- B. Incorrect.
This option is incorrect because metadata server access is internal to the instance and cannot be controlled by external firewall rules. Firewall rules are used for managing external traffic, not internal metadata access.
- C. Correct.
This option is correct because enabling metadata concealment ensures that only the local instance can access its metadata server, preventing other entities from accessing sensitive metadata.
- D. Correct.
This option is correct because setting the 'metadata-flavor' header to 'Google' helps protect against unauthorized access by ensuring that only valid API requests explicitly include this header.
- E. Correct.
This option is correct because using IAM roles and service accounts helps enforce the principle of least privilege, reducing the risk of unauthorized access to metadata or other resources.