Google Professional Cloud Security Engineer Question 45
Select 3Google Cloud PlatformYou are responsible for securing service accounts in your Google Cloud environment. A developer has created a new Compute Engine instance, but you notice that it is using the default Compute Engine service account with overly permissive roles. What steps should you take to ensure the service account is secured while maintaining the instance's functionality?
- A
Restrict the roles assigned to the default Compute Engine service account to only the permissions required for the instance.
- B
Disable the default Compute Engine service account to prevent its misuse and create a custom service account with least privilege.
- C
Ensure the service account key is stored securely by downloading it and encrypting it locally.
- D
Enable Workload Identity Federation to replace the use of service account keys for the instance.
- E
Audit and remove any unnecessary permissions granted to the default Compute Engine service account across the project.
Show answer and explanation
Correct answers: A, B, E
Explanation
To secure service accounts, you should follow the principle of least privilege by restricting permissions, auditing current permissions, and, where possible, replacing default service accounts with custom service accounts. Avoid managing service account keys manually, as this introduces potential security risks, and prefer automated authentication mechanisms provided by Google Cloud. Workload Identity Federation is a valuable tool but is not relevant in this specific scenario of securing a Compute Engine service account.
- A. Correct.
Restricting the roles assigned to the default service account ensures it has only the permissions necessary for the instance's functionality, reducing the risk of privilege escalation or misuse.
- B. Correct.
Disabling the default service account and replacing it with a custom service account follows the best practice of using least privilege and reducing the attack surface.
- C. Incorrect.
Downloading and encrypting the service account key locally is not recommended as it increases the risk of the key being exposed or mismanaged. Instead, avoid managing keys manually.
- D. Incorrect.
Workload Identity Federation is a useful feature but is not directly applicable in this scenario where the instance is using a default Compute Engine service account.
- E. Correct.
Auditing and removing unnecessary permissions helps prevent privilege escalation and ensures the principle of least privilege is applied across the project.