Google Professional Cloud Security Engineer Question 50
Select 2Google Cloud PlatformYou are designing a Google Cloud application that processes sensitive data and needs to access a Cloud Storage bucket and a BigQuery dataset. The application runs on Compute Engine instances across multiple projects. Which of the following configurations require the use of service accounts?
- A
Assigning a specific IAM role to the application to access the Cloud Storage bucket.
- B
Creating a service account and assigning it to the Compute Engine instances for accessing the required resources.
- C
Using the default Compute Engine service account without any modification.
- D
Configuring a service account with minimal permissions to access both the Cloud Storage bucket and the BigQuery dataset.
- E
Granting public access to the Cloud Storage bucket to avoid additional configurations.
Show answer and explanation
Correct answers: B, D
Explanation
Service accounts are used to provide secure and controlled access to resources for applications or virtual machines. In this scenario, the application needs to interact with multiple Google Cloud resources (Cloud Storage and BigQuery), and assigning a dedicated service account with minimal permissions ensures secure, programmatic access while adhering to the principle of least privilege. Using the default service account or granting public access poses significant security risks.
- A. Incorrect.
Incorrect. IAM roles are assigned to users, groups, or service accounts. To ensure secure, programmatic access to resources, a service account is required.
- B. Correct.
Correct. A dedicated service account for the Compute Engine instances ensures secure, programmatic access to the resources across projects while following the principle of least privilege.
- C. Incorrect.
Incorrect. While the default Compute Engine service account can be used, it generally has overly permissive access, which is not recommended for sensitive data or production workloads.
- D. Correct.
Correct. Creating a service account with minimal permissions ensures secure access to only the required resources and aligns with best practices for security.
- E. Incorrect.
Incorrect. Granting public access to the Cloud Storage bucket exposes sensitive data to unauthorized users and violates security best practices.