Google Professional Cloud Security Engineer Question 60
Select 5Google Cloud PlatformYour organization uses Google Cloud and has identified a potential risk where service account keys are being used insecurely across multiple projects. As a Professional Cloud Security Engineer, what steps should you take to secure, audit, and mitigate the usage of service account keys?
- A
Rotate all existing service account keys periodically and enforce key expiration policies.
- B
Ensure no service account keys are stored in source code repositories by implementing automated scanning tools.
- C
Enable the 'Disable Automatic Key Creation' policy to prevent the creation of new service account keys.
- D
Grant service accounts the Owner role to ensure they have sufficient permissions for all tasks.
- E
Identify and delete unused service account keys using the Google Cloud Console or CLI.
- F
Configure IAM Conditions to restrict the usage of long-lived service account keys to specific environments or IP ranges.
Show answer and explanation
Correct answers: A, B, C, E, F
Explanation
To secure, audit, and mitigate the usage of service account keys in Google Cloud, it is essential to follow best practices such as key rotation, preventing keys from being stored in repositories, restricting key creation, and deleting unused keys. Additionally, IAM Conditions can be applied to enforce stricter security controls. Avoid granting overly permissive roles like Owner, as they increase the risk of security breaches.
- A. Correct.
Rotating service account keys periodically and enforcing key expiration policies is a best practice to minimize the risk of compromised keys being misused.
- B. Correct.
It is critical to ensure service account keys are not stored in source code repositories where they can be exposed to unauthorized access. Automated scanning tools can help detect such issues.
- C. Correct.
Disabling automatic key creation is an effective way to limit the proliferation of service account keys and enforce stricter control over their usage.
- D. Incorrect.
Granting service accounts the Owner role violates the principle of least privilege and unnecessarily increases security risks. Service accounts should only be granted the minimum permissions they need.
- E. Correct.
Deleting unused service account keys is essential to reduce the attack surface and prevent unauthorized access using stale or unused keys.
- F. Correct.
IAM Conditions can be used to enforce granular controls, such as restricting the usage of service account keys to specific environments or IP ranges, enhancing security.