Google Professional Cloud Security Engineer Question 72
Single answerGoogle Cloud PlatformYour organization uses an on-premises identity provider (IdP) to manage user authentication and is migrating some workloads to Google Cloud. To securely allow on-premises workloads to access Google Cloud resources without using long-lived service account keys, you decide to configure Workload Identity Federation. What is the recommended first step to set up Workload Identity Federation for this scenario?
- A
Create a service account in Google Cloud and grant it access to the required resources.
- B
Create an identity pool and configure a trust configuration to link it with your on-premises IdP.
- C
Enable the Identity-Aware Proxy (IAP) in your Google Cloud project.
- D
Generate and distribute short-lived OAuth 2.0 tokens for your workloads.
Show answer and explanation
Correct answer: B
Explanation
The correct first step to configure Workload Identity Federation is to create an identity pool and set up a trust configuration to link your on-premises identity provider with Google Cloud. This establishes the foundational integration, enabling workloads to authenticate securely using short-lived credentials instead of long-lived service account keys.
- A. Incorrect.
While creating a service account is necessary for accessing resources, it doesn't establish the connection between the on-premises IdP and Google Cloud. This step is not the first in setting up Workload Identity Federation.
- B. Correct.
Creating an identity pool and configuring a trust configuration is the correct first step. This allows you to establish a federation between your on-premises IdP and Google Cloud, enabling secure authentication without using long-lived credentials.
- C. Incorrect.
Enabling the Identity-Aware Proxy (IAP) is not relevant to setting up Workload Identity Federation. IAP is used to protect application access, not to federate identities.
- D. Incorrect.
Generating and distributing short-lived tokens is a part of the process, but it is not the first step. Short-lived tokens are issued after the identity pool and trust configuration are established.