Google Professional Cloud Security Engineer Question 70
Select 2Google Cloud PlatformYour team uses Google Cloud to manage a critical application. To enhance security, you are tasked with implementing short-lived credentials for accessing resources in Google Cloud. Which of the following approaches align with this requirement?
- A
Use Service Account Keys to authenticate and rotate them manually every 30 days.
- B
Enable Workload Identity Federation to allow external identities to access Google Cloud resources with temporary credentials.
- C
Configure OAuth 2.0 access tokens with limited lifetimes for accessing Google Cloud APIs.
- D
Use Identity and Access Management (IAM) roles with long-lived credentials to ensure continuous access.
- E
Leverage Customer Managed Encryption Keys (CMEK) for encrypting sensitive data.
Show answer and explanation
Correct answers: B, C
Explanation
To manage and create short-lived credentials, you can use mechanisms like Workload Identity Federation to avoid long-lived Service Account Keys, or configure OAuth 2.0 access tokens with limited lifetimes. These approaches ensure secure and temporary access to Google Cloud resources, aligning with the principle of least privilege and reducing the risk of credential compromise.
- A. Incorrect.
Service Account Keys are not short-lived credentials. They are long-lived by default and require manual rotation, which is prone to human error and security risks.
- B. Correct.
Workload Identity Federation allows external identities to authenticate without using long-lived Service Account Keys by exchanging external credentials for short-lived access tokens. This approach aligns with the requirement.
- C. Correct.
OAuth 2.0 access tokens can be configured with limited lifetimes, making them suitable for short-lived credentials to access Google Cloud APIs.
- D. Incorrect.
IAM roles themselves do not provide short-lived credentials. They are used to define permissions, but the credentials associated with IAM roles can be long-lived unless additional mechanisms (e.g., Workload Identity Federation) are implemented.
- E. Incorrect.
Customer Managed Encryption Keys (CMEK) are used for encrypting sensitive data, not for managing short-lived credentials.