Google Professional Cloud Security Engineer Question 56
Select 2Google Cloud PlatformYour organization uses a Google Cloud project to host multiple microservices. Each microservice runs on a Compute Engine instance and uses a dedicated service account for accessing other Google Cloud resources. You need to update the permissions for one of the service accounts to access a newly deployed Cloud Storage bucket. What steps should you take to accomplish this?
- A
Use the Google Cloud Console to assign the appropriate IAM role to the service account for the Cloud Storage bucket.
- B
Disable the service account and create a new one with the required permissions.
- C
Use the
gcloudCLI to grant the service account the appropriate IAM role for the Cloud Storage bucket. - D
Update the Compute Engine instance configuration to use a new service account with permissions for the Cloud Storage bucket.
- E
Add the service account to the Cloud Storage bucket's access control list (ACL) and assign it the required permissions.
Show answer and explanation
Correct answers: A, C
Explanation
To grant a service account access to a new resource, you should assign the necessary IAM roles to it. This can be done via the Google Cloud Console or the gcloud CLI. Creating a new service account or modifying the Compute Engine instance configuration is unnecessary if the existing service account can be updated. Using IAM roles is the recommended approach over using ACLs for resource permissions.
- A. Correct.
Correct: Assigning the appropriate IAM role to the service account via the Google Cloud Console is a valid method for granting permissions.
- B. Incorrect.
Incorrect: Disabling the service account and creating a new one is unnecessary and disrupts existing workloads using the original service account.
- C. Correct.
Correct: Using the
gcloudCLI to assign an IAM role is another valid method to grant permissions to the service account. - D. Incorrect.
Incorrect: Updating the Compute Engine instance configuration to use a new service account is unnecessary when you can simply modify the permissions of the existing service account.
- E. Incorrect.
Incorrect: Cloud Storage ACLs are not the recommended way to manage permissions for service accounts. IAM roles provide a more centralized and scalable approach.