Google Professional Cloud Security Engineer Question 49
Single answerGoogle Cloud PlatformYou are designing a new application on Google Cloud that requires interaction between a Compute Engine instance and a Cloud Storage bucket. The Compute Engine instance needs to upload files to the bucket without user intervention. Which approach should you take to ensure secure and appropriate access?
- A
Manually create a user-managed key and assign it to the Compute Engine instance.
- B
Use a service account and grant it the appropriate roles for accessing the Cloud Storage bucket.
- C
Embed the Cloud Storage bucket credentials in the application code running on the Compute Engine instance.
- D
Share the Cloud Storage bucket with the public and use a public URL for uploads.
Show answer and explanation
Correct answer: B
Explanation
Service accounts are ideal for scenarios where Google Cloud resources, such as Compute Engine, need to securely access other resources, like Cloud Storage buckets. In this case, assigning a service account to the Compute Engine instance and granting it the appropriate roles ensures that the application can securely and seamlessly upload files to the bucket while adhering to the principle of least privilege.
- A. Incorrect.
Manually creating and managing keys increases the operational burden and security risks, such as accidental key exposure. It is not the best practice for this scenario.
- B. Correct.
Using a service account is the most secure and recommended approach. Service accounts are designed for scenarios where applications or services need to interact securely with Google Cloud resources.
- C. Incorrect.
Embedding credentials directly in application code is a major security risk. If the code is exposed or shared, the credentials could be compromised.
- D. Incorrect.
Making the Cloud Storage bucket public is not secure and violates the principle of least privilege. It allows unrestricted access, which is unnecessary and dangerous for this use case.