Google Professional Cloud Security Engineer Question 46
Select 3Google Cloud PlatformYour organization uses a Compute Engine virtual machine (VM) to run a critical application. The VM is configured to use a default service account with the 'Editor' role assigned. A recent security audit flagged this as a potential risk, and you are tasked with securing the service account. Which actions should you take to mitigate the security risk?
- A
Restrict the default service account's permissions by assigning only the necessary roles for the application.
- B
Disable the default service account entirely to prevent any potential misuse.
- C
Replace the default service account with a custom service account that has the least privilege access required by the application.
- D
Ensure the default service account is encrypted using a customer-managed encryption key (CMEK).
- E
Enable logging and monitoring for service account activities to detect any suspicious behavior.
Show answer and explanation
Correct answers: A, C, E
Explanation
To secure the default service account, you should follow the principle of least privilege by restricting its permissions or replacing it with a custom service account with the minimum required permissions. Additionally, enabling logging and monitoring helps detect and respond to potential security incidents involving service accounts. Disabling the default service account is not recommended unless it is unused, and encryption using CMEK is not applicable to service accounts.
- A. Correct.
Restricting permissions ensures that the default service account adheres to the principle of least privilege, minimizing the risk of misuse.
- B. Incorrect.
Disabling the default service account may break existing workloads that rely on it, and thus is not a recommended approach unless the account is unused.
- C. Correct.
Replacing the default service account with a custom service account allows better control over permissions and aligns with best practices for security.
- D. Incorrect.
Service accounts are not encrypted using CMEK. This option is not relevant to securing service accounts.
- E. Correct.
Logging and monitoring provide visibility into service account usage and help identify any unauthorized or suspicious activities.