Google Professional Cloud Security Engineer Question 55
Select 3Google Cloud PlatformYour organization uses a Google Cloud project to host a web application. The application uses a Compute Engine instance to process user requests and store data in Cloud Storage. You need to ensure the Compute Engine instance has the necessary permissions to access Cloud Storage without exposing credentials. Which steps should you take?
- A
Create a service account and assign it the Storage Object Viewer role.
- B
Attach the service account to the Compute Engine instance.
- C
Generate and download a key file for the service account, then upload it to the Compute Engine instance.
- D
Disable the service account after attaching it to the Compute Engine instance to ensure security.
- E
Ensure that the Compute Engine instance is authorized to use the service account's credentials.
Show answer and explanation
Correct answers: A, B, E
Explanation
To securely provide the Compute Engine instance with access to Cloud Storage, you need to create a service account with the appropriate permissions (Storage Object Viewer), attach it to the instance, and ensure proper authorization. This approach avoids exposing credentials and follows Google Cloud best practices for using service accounts. Downloading and uploading key files or disabling the service account would either increase security risks or break functionality.
- A. Correct.
Correct. Creating a service account and assigning it the appropriate role (Storage Object Viewer) ensures the Compute Engine instance has the necessary permissions to access Cloud Storage.
- B. Correct.
Correct. Attaching the service account to the Compute Engine instance allows the instance to use the service account for authentication without managing private keys.
- C. Incorrect.
Incorrect. Google Cloud best practices recommend using service accounts directly with IAM roles rather than downloading and uploading key files, as this approach avoids the risk of key file exposure.
- D. Incorrect.
Incorrect. Disabling a service account after attaching it to an instance will revoke its access, effectively breaking the connection between the instance and the required resources.
- E. Correct.
Correct. Ensuring that the Compute Engine instance is authorized to use the service account's credentials is a necessary step for the instance to access Cloud Storage.