Google Professional Cloud Security Engineer Question 58
Select 3Google Cloud PlatformYour organization uses a Google Cloud project to host an application that requires different components to interact with each other using service accounts. You have been tasked with ensuring that a specific service account used by a Compute Engine instance has permissions to write logs to Cloud Storage but cannot be used by any other service. Which of the following actions should you take?
- A
Grant the 'roles/storage.objectCreator' role to the service account on the Cloud Storage bucket.
- B
Disable the service account when it is not actively in use.
- C
Restrict the scope of the service account to only be used by the specific Compute Engine instance.
- D
Enable the 'iam.serviceAccountUser' role for the service account to allow interaction with other services.
- E
Use an organization policy to restrict the service account from being used outside the project.
Show answer and explanation
Correct answers: A, C, E
Explanation
To securely configure a service account for a Compute Engine instance, you need to grant it the minimum required permissions, ensure it is scoped to the intended use case, and prevent misuse in other contexts. Granting 'roles/storage.objectCreator' allows the service account to write logs to Cloud Storage. Restricting the service account to the Compute Engine instance ensures it is not used elsewhere. Additionally, an organization policy preventing the service account's usage outside the project adds further security. Disabling the service account or granting excessive permissions goes against the principle of least privilege.
- A. Correct.
Granting the 'roles/storage.objectCreator' role to the service account ensures it has permission to write logs to the Cloud Storage bucket. This is necessary for the required functionality.
- B. Incorrect.
Disabling the service account when not in use could disrupt the application because the Compute Engine instance would not be able to use the service account.
- C. Correct.
Restricting the scope of the service account to only the specific Compute Engine instance ensures that the service account cannot be exploited by other services, improving security.
- D. Incorrect.
Granting the 'iam.serviceAccountUser' role would increase the service account's permissions and allow other services to use it, which is the opposite of the security goal.
- E. Correct.
Using an organization policy to restrict the service account from being used outside the project ensures it cannot be used in unintended contexts, adding an additional layer of security.