Google Professional Cloud Security Engineer Question 42
Select 3Google Cloud PlatformYour organization is using Google Cloud and has multiple service accounts for various workloads. One of the service accounts is overprivileged and puts your infrastructure at risk due to excessive permissions. What steps should you take to align with Google Cloud's best practices for managing service accounts?
- A
Remove unused service accounts and associated keys.
- B
Assign the service account the Owner role at the project level for simplicity.
- C
Use the principle of least privilege to assign only necessary roles to the service account.
- D
Rotate the service account key regularly or use workload identity federation to avoid using keys altogether.
- E
Share the service account credentials with developers so they can troubleshoot issues more efficiently.
Show answer and explanation
Correct answers: A, C, D
Explanation
To manage service accounts securely, it is essential to follow best practices such as removing unused accounts and keys, minimizing permissions using the principle of least privilege, and reducing reliance on service account keys through mechanisms like workload identity federation. These actions help mitigate risks associated with overprivileged or improperly managed service accounts.
- A. Correct.
Removing unused service accounts and their keys reduces the attack surface and helps ensure that only necessary accounts exist in the environment.
- B. Incorrect.
Assigning the Owner role at the project level violates the principle of least privilege and grants excessive permissions, which is not a best practice.
- C. Correct.
Using the principle of least privilege ensures that the service account has only the permissions required for its tasks, minimizing potential risks.
- D. Correct.
Rotating the service account key regularly helps reduce the risk of key compromise. Using workload identity federation can eliminate the need for keys, further enhancing security.
- E. Incorrect.
Sharing service account credentials is a security risk and violates best practices, as it can lead to unauthorized access or misuse.