Google Professional Cloud Security Engineer Question 68
Single answerGoogle Cloud PlatformYour organization uses Google Cloud and is implementing a policy to minimize the risk of credential abuse by adopting short-lived credentials. You are tasked with configuring a service account for a cloud application that needs to perform tasks on Compute Engine and Cloud Storage. How should you manage authentication to ensure the credentials are short-lived while maintaining secure access?
- A
Configure the application to use a service account key file and rotate it every 90 days.
- B
Use Workload Identity Federation to allow the application to exchange external credentials for short-lived access tokens.
- C
Manually generate short-lived OAuth 2.0 tokens for the service account and embed them in the application.
- D
Attach the service account directly to the Compute Engine instances running the application and rely on the metadata server for token generation.
Show answer and explanation
Correct answer: B
Explanation
The best solution for managing short-lived credentials in this scenario is to use Workload Identity Federation (Option 2), as it allows the application to securely exchange external identity credentials for short-lived Google Cloud access tokens without relying on long-lived service account keys. This minimizes the risk of credential abuse and aligns with best practices for secure authentication in Google Cloud environments.
- A. Incorrect.
This approach relies on long-lived service account keys, which are susceptible to compromise and are not ideal for short-lived credential management.
- B. Correct.
Workload Identity Federation allows applications to use external identity providers to exchange credentials for short-lived Google Cloud access tokens, eliminating the need for long-lived keys and enhancing security.
- C. Incorrect.
Manually generating and embedding OAuth 2.0 tokens is not practical for automation, error-prone, and creates a management overhead, making it a poor option for secure and scalable short-lived credential management.
- D. Incorrect.
While attaching a service account to Compute Engine instances enables the use of short-lived tokens via the metadata server, this approach does not apply to external or non-Google Cloud-hosted applications. It is also less flexible than Workload Identity Federation for external applications.