Google Professional Cloud Security Engineer Question 61
Select 3Google Cloud PlatformYour organization uses several Google Cloud service accounts for automation purposes. A security audit reveals that some service account keys are being used inappropriately, and there are potential risks of unauthorized access. As a Professional Cloud Security Engineer, what steps should you take to secure and mitigate the usage of service account keys?
- A
Disable all service account keys and rely only on OAuth tokens for authentication.
- B
Rotate service account keys regularly and ensure unused keys are deleted.
- C
Use customer-managed encryption keys (CMEK) to encrypt service account keys stored in Cloud Storage.
- D
Restrict the creation of new service account keys using organization policies.
- E
Audit the usage of service account keys via Cloud Logging and identify any unauthorized access or anomalies.
Show answer and explanation
Correct answers: B, D, E
Explanation
To secure and mitigate the usage of service account keys, it is essential to follow best practices like rotating keys regularly, restricting their creation, and auditing their usage. This minimizes the risk of unauthorized access and improves overall security. Disabling all keys is impractical, and using CMEK is not directly relevant to this scenario.
- A. Incorrect.
Disabling all service account keys is not practical as some workflows may require their use. However, minimizing their use and securing them is a better approach.
- B. Correct.
Rotating service account keys regularly and deleting unused keys reduces the risk of compromise due to stale or exposed keys. This is a recommended security practice.
- C. Incorrect.
While CMEK can secure sensitive data in Cloud Storage, it is not directly relevant to securing service account keys.
- D. Correct.
Restricting the creation of new service account keys via organization policies is a proactive way to ensure that keys are not created unnecessarily, reducing their potential misuse.
- E. Correct.
Auditing the usage of service account keys via Cloud Logging is essential for identifying unauthorized access or unusual activity, enabling prompt mitigation.