Google Professional Cloud Security Engineer Question 52
Select 2Google Cloud PlatformYou are designing a Google Cloud environment for a new application. The application consists of multiple microservices running in Google Kubernetes Engine (GKE). These microservices need to communicate securely with Cloud Storage for object storage and Pub/Sub for messaging. Which scenario would require the use of service accounts?
- A
Configuring microservices to authenticate with Cloud Storage and Pub/Sub without exposing credentials
- B
Allowing end users to directly upload files to Cloud Storage using their personal Google accounts
- C
Granting a GKE workload permission to access a Cloud SQL database
- D
Restricting access to Pub/Sub topics based on specific roles and permissions
- E
Logging all API calls made by microservices to Cloud Storage and Pub/Sub for auditing purposes
Show answer and explanation
Correct answers: A, C
Explanation
Service accounts are used to securely authenticate and authorize workloads, such as GKE microservices, to access Google Cloud services like Cloud Storage, Pub/Sub, or Cloud SQL. In this scenario, service accounts ensure that the microservices can operate securely without exposing sensitive credentials. Scenarios like end-user authentication or logging API calls, however, do not require service accounts.
- A. Correct.
Correct: Service accounts are used to authenticate workloads like microservices with Google Cloud services (e.g., Cloud Storage and Pub/Sub) securely, without the need to expose credentials.
- B. Incorrect.
Incorrect: End-user authentication for direct access to Cloud Storage typically uses OAuth 2.0 with personal Google accounts, not service accounts.
- C. Correct.
Correct: Service accounts are essential for granting a GKE workload (e.g., a pod) secure access to Google Cloud services such as Cloud SQL.
- D. Incorrect.
Incorrect: Restricting access to Pub/Sub topics based on roles and permissions involves Identity and Access Management (IAM) but does not necessarily require service accounts.
- E. Incorrect.
Incorrect: Logging API calls is managed through audit logging in Google Cloud, which does not inherently require service accounts.