Google Professional Cloud Security Engineer Question 47
Select 4Google Cloud PlatformYour organization is using Google Cloud for hosting applications that require service accounts to interact with various APIs and resources. You have discovered that some default service accounts have overly permissive roles, which could lead to potential security risks. As a Cloud Security Engineer, what steps should you take to ensure the service accounts are properly secured?
- A
Restrict the roles assigned to service accounts to the minimum necessary permissions.
- B
Disable unused default service accounts to minimize the attack surface.
- C
Grant the Owner role to all default service accounts to ensure they can access all necessary resources.
- D
Use workload identity federation to replace service account keys wherever possible.
- E
Regularly audit service account permissions and remove any unnecessary access.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To secure and protect service accounts, it is crucial to adhere to best practices such as implementing the principle of least privilege, disabling unused accounts, eliminating the use of long-lived credentials where possible, and performing regular audits. These actions minimize the risk of unauthorized access and ensure compliance with security standards.
- A. Correct.
Restricting roles to the minimum necessary permissions follows the principle of least privilege, which minimizes the risk of misuse or unauthorized access.
- B. Correct.
Disabling unused default service accounts reduces the attack surface and prevents unauthorized access through inactive accounts.
- C. Incorrect.
Granting the Owner role to default service accounts is a poor practice as it provides overly broad access, violating the principle of least privilege.
- D. Correct.
Workload identity federation eliminates the need for long-lived service account keys, reducing the risk of credential compromise.
- E. Correct.
Regularly auditing permissions ensures that service accounts do not retain access they no longer require, aligning with best practices for access management.