Google Professional Cloud Security Engineer Question 66
Single answerGoogle Cloud PlatformYour organization is using Google Cloud and has a requirement to grant developers the ability to access GCP resources for debugging purposes. To adhere to security best practices, you need to ensure that the credentials provided are short-lived and scoped specifically for their tasks. Which solution would best meet this requirement?
- A
Use IAM roles with predefined permissions and generate access keys that are stored in the developer's personal devices.
- B
Utilize the Service Account Credentials API to generate short-lived OAuth 2.0 access tokens for specific IAM roles.
- C
Create a custom service account for each developer and assign long-term keys for persistent access.
- D
Grant developers the Owner role temporarily and revoke the permission after the debugging session ends.
Show answer and explanation
Correct answer: B
Explanation
The Service Account Credentials API is the recommended way to generate short-lived credentials for specific roles in Google Cloud. This ensures that developers have access only for the necessary tasks and time frame, aligning with security best practices like the principle of least privilege and minimizing exposure of credentials.
- A. Incorrect.
This option does not align with the principle of least privilege or security best practices, as storing long-term access keys on personal devices increases the risk of compromise.
- B. Correct.
This is the correct solution. The Service Account Credentials API allows you to securely generate short-lived credentials (OAuth 2.0 tokens) scoped to specific roles and permissions, which can be used for temporary access.
- C. Incorrect.
Assigning long-term keys violates security best practices, as it increases the risk of unauthorized access if keys are compromised. Short-lived credentials are preferred.
- D. Incorrect.
Granting the Owner role even temporarily violates the principle of least privilege and could lead to excessive permissions being misused. It's not a recommended practice.