Google Professional Cloud Security Engineer Question 51
Select 3Google Cloud PlatformYou are designing a secure Google Cloud application that needs to interact with multiple Google Cloud services, including Cloud Storage and BigQuery. The application runs on Compute Engine instances and must authenticate itself to access these services. Which of the following scenarios justify the use of a service account?
- A
The application running on the Compute Engine instance requires granular permissions to access specific resources in Cloud Storage and BigQuery.
- B
The application requires users to authenticate manually using their Google accounts before accessing Cloud Storage or BigQuery.
- C
The application needs to authenticate non-Google Cloud resources, such as a third-party API, using an API key.
- D
The application runs on Compute Engine and must automatically authenticate to access Google Cloud services without hardcoding credentials.
- E
The application is hosted on-premises and needs to access Google Cloud services using a service account JSON key file.
Show answer and explanation
Correct answers: A, D, E
Explanation
Service accounts are intended for applications or resources that need to authenticate and interact with Google Cloud services. They provide a secure way to grant specific roles and permissions to applications, ensuring the principle of least privilege. In this scenario, using service accounts is justified for granular permissions, automatic authentication on Compute Engine, and access from external environments using JSON key files. User authentication and third-party API access are not use cases for service accounts.
- A. Correct.
Correct. Service accounts are best suited for applications that need granular permissions to access specific Google Cloud resources.
- B. Incorrect.
Incorrect. Service accounts are not used for user authentication. Instead, user accounts are required for this scenario.
- C. Incorrect.
Incorrect. Service accounts are not used to authenticate to third-party APIs. API keys or other mechanisms are more appropriate for such use cases.
- D. Correct.
Correct. Service accounts allow applications running on Compute Engine to authenticate automatically using attached service account credentials without hardcoding sensitive information.
- E. Correct.
Correct. Service account JSON key files are used when an application or resource outside Google Cloud needs to authenticate with Google Cloud services.