Google Professional Cloud Security Engineer Question 37
Select 3Google Cloud PlatformYour organization has multiple Google Cloud projects, and you are tasked with creating a new service account that will be used by a CI/CD pipeline to deploy resources across these projects. You are required to ensure that the principle of least privilege is followed, and the service account is secure. Which of the following actions should you take to meet these requirements?
- A
Grant the service account only the roles it needs to perform its tasks.
- B
Store the private key for the service account in a secure location, such as a secret manager.
- C
Assign the Owner role to the service account across all projects for maximum access.
- D
Rotate the service account key regularly to prevent misuse.
- E
Enable the service account for unmanaged access by external applications.
Show answer and explanation
Correct answers: A, B, D
Explanation
To securely manage a service account used by a CI/CD pipeline, it is critical to follow the principle of least privilege by assigning only necessary roles. Private keys should be securely stored to prevent unauthorized access, and regular key rotation helps mitigate the risk of misuse. Avoid assigning overly permissive roles such as Owner and exposing the service account to unmanaged access, as these practices can compromise security.
- A. Correct.
Granting only the required roles ensures the service account adheres to the principle of least privilege, reducing the risk of accidental or intentional misuse.
- B. Correct.
Storing the private key securely, such as in a secret manager, ensures unauthorized users cannot access it, enhancing security.
- C. Incorrect.
Assigning the Owner role gives excessive permissions and violates the principle of least privilege, making it a bad practice.
- D. Correct.
Regularly rotating the service account keys reduces the risk of misuse, especially if keys are accidentally exposed.
- E. Incorrect.
Enabling unmanaged access for external applications increases the risk of unauthorized access and is not a secure practice.