Google Professional Cloud Security Engineer Question 59
Select 2Google Cloud PlatformYour team is building a new application on Google Cloud, and you need to set up a service account to allow the application to interact with Google Cloud resources securely. The application should only have the ability to write logs to Cloud Logging and read data from a specific Cloud Storage bucket. As the security engineer, what steps should you take to meet this requirement?
- A
Create a new service account and grant it the 'Storage Object Viewer' role at the bucket level and the 'Logs Writer' role at the project level.
- B
Grant the service account the 'Owner' role at the project level to ensure it has all necessary permissions.
- C
Create a new service account, disable the default Compute Engine service account, and assign the 'Storage Admin' role to the new service account.
- D
Restrict the service account's access by granting the 'Storage Object Viewer' role only for the specific bucket, and the 'Logs Writer' role only at the project level.
- E
Disable the service account after the application deployment is complete to enhance security.
Show answer and explanation
Correct answers: A, D
Explanation
To securely configure a service account, it is critical to adhere to the principle of least privilege by granting only the permissions that are necessary for the application's functionality. In this scenario, the application requires 'Storage Object Viewer' access for a specific bucket and 'Logs Writer' access at the project level. Options 1 and 4 implement these permissions correctly. Options 2 and 3 provide excessive or irrelevant permissions, and Option 5 compromises the application's ability to function.
- A. Correct.
Correct: This option assigns the minimal required permissions ('Storage Object Viewer' for accessing the specific Cloud Storage bucket and 'Logs Writer' for writing logs) to the new service account, adhering to the principle of least privilege.
- B. Incorrect.
Incorrect: Granting the 'Owner' role at the project level violates the principle of least privilege, as it provides excessive permissions that are not necessary for this use case.
- C. Incorrect.
Incorrect: Disabling the default Compute Engine service account is not relevant to this scenario, and assigning the 'Storage Admin' role grants broader permissions than what is required, violating the principle of least privilege.
- D. Correct.
Correct: This option ensures that the service account is restricted to only the necessary permissions, with access scoped appropriately to the specific bucket and project.
- E. Incorrect.
Incorrect: Disabling the service account after deployment would prevent the application from functioning, as it would lose access to the necessary resources.