Google Professional Cloud Security Engineer Question 64
Select 4Google Cloud PlatformYour organization uses Google Cloud and has discovered that several service account keys have been shared insecurely, potentially exposing sensitive credentials. As a Professional Cloud Security Engineer, what actions should you take to secure and mitigate the usage of these service account keys?
- A
Disable or delete the exposed service account keys immediately.
- B
Audit the usage of the exposed service account keys by reviewing Cloud Logging.
- C
Rotate the affected service account keys by generating new ones and distributing them securely.
- D
Restrict the service accounts from being used by unauthorized users through IAM policies.
- E
Enable Cloud Asset Inventory to automatically delete all exposed service account keys.
Show answer and explanation
Correct answers: A, B, C, D
Explanation
When service account keys are exposed, it is critical to act quickly to mitigate potential security risks. Disabling or deleting the keys prevents misuse, auditing their usage helps identify any unauthorized access, and rotating the keys ensures their replacement with securely distributed alternatives. Additionally, restricting access through IAM policies enforces security best practices. However, enabling Cloud Asset Inventory is not directly relevant to mitigating exposed keys, as it does not provide automatic deletion of credentials.
- A. Correct.
Disabling or deleting the exposed service account keys immediately limits the risk of unauthorized access by preventing the keys from being used further.
- B. Correct.
Auditing the usage of the exposed keys through Cloud Logging allows you to identify any unauthorized access or suspicious activities associated with the keys.
- C. Correct.
Rotating the affected service account keys ensures that new keys are generated to replace the compromised ones, while securely distributing them minimizes the risk of future exposure.
- D. Correct.
Restricting service accounts through IAM policies helps enforce the principle of least privilege, ensuring that only authorized users or services can access specific resources.
- E. Incorrect.
Cloud Asset Inventory does not have a feature to automatically delete exposed service account keys. While it can help in identifying assets, it does not mitigate key exposure.