Google Professional Cloud Security Engineer Question 69
Single answerGoogle Cloud PlatformYour organization is using Google Cloud for a critical workload and requires fine-grained access controls for users and applications. You are tasked with implementing short-lived credentials for a service that needs to access Cloud Storage for a limited time. Which solution should you implement to meet this requirement?
- A
Use OAuth 2.0 access tokens generated with a Service Account and set a limited expiration time.
- B
Generate signed URLs for the service to access specific Cloud Storage objects with an expiration time.
- C
Assign the service a permanent IAM role with the required permissions.
- D
Use a user-managed key pair to generate long-lived credentials for authentication.
Show answer and explanation
Correct answer: B
Explanation
Signed URLs are the recommended approach for granting temporary, fine-grained access to specific Cloud Storage objects. They allow you to define an expiration time, ensuring the credentials are short-lived and meet the security requirements for this scenario.
- A. Incorrect.
OAuth 2.0 access tokens are valid for a short time (typically 1 hour) but are not directly suitable for controlling access to specific Cloud Storage objects. Signed URLs are a more appropriate solution for object-level access control.
- B. Correct.
Signed URLs allow you to grant temporary access to specific Cloud Storage objects by specifying an expiration time. This meets the requirement for short-lived credentials.
- C. Incorrect.
Assigning a permanent IAM role provides long-term access and does not meet the requirement for short-lived credentials.
- D. Incorrect.
User-managed key pairs generate long-lived credentials, which contradict the requirement for short-lived credentials. They also increase security risks if the keys are exposed.