Google Professional Cloud Security Engineer Question 63
Select 3Google Cloud PlatformYour organization uses Google Cloud and has a number of service accounts configured for various applications. A security audit reveals that some service account private keys were manually created and distributed to developers, which violates the organization's security policies. What steps should you take to mitigate the risks associated with these service account keys?
- A
Identify and delete all unauthorized service account keys.
- B
Disable the service accounts with manually created keys and create new ones.
- C
Enforce the use of keyless service accounts by utilizing Workload Identity Federation where possible.
- D
Rotate all keys and limit access to the new private keys using IAM roles.
- E
Enable Cloud Audit Logs to track the usage of service account keys.
Show answer and explanation
Correct answers: A, C, E
Explanation
To mitigate risks associated with unauthorized service account keys, it is essential to identify and delete any keys that violate security policies, enforce keyless authentication where possible, and enable logging to track key usage. These steps help secure service accounts, minimize risks, and ensure compliance with organizational security policies.
- A. Correct.
Deleting unauthorized service account keys is a necessary step to immediately mitigate potential misuse of these keys.
- B. Incorrect.
Disabling service accounts entirely can disrupt operations; instead, the focus should be on key management and policy enforcement.
- C. Correct.
Workload Identity Federation eliminates the need for long-lived service account keys and is a best practice for securing service accounts.
- D. Incorrect.
Rotating keys is important, but it does not directly address the issue of unauthorized key creation or eliminate the misuse of service account keys.
- E. Correct.
Enabling Cloud Audit Logs helps monitor key usage and detect any unauthorized or suspicious activity.