Google Professional Cloud Security Engineer exam dumps

Google Professional Cloud Security Engineer practice question 73 of 501

Professional Cloud Security Engineer. Expert level, Google Cloud. Free question with the correct answer and a full explanation.

Google Professional Cloud Security Engineer Question 73

Select 2Google Cloud Platform

Your organization has multiple workloads running on AWS, and you want these workloads to securely access Google Cloud services such as BigQuery and Cloud Storage without using long-lived credentials. Which steps should you take to configure Workload Identity Federation to achieve this goal?

  1. A

    Create and configure an identity provider in Google Cloud to trust the AWS IAM identity source.

  2. B

    Generate a GCP service account key and upload it to an AWS instance to enable access to Google Cloud services.

  3. C

    Create a Google Cloud service account and grant it appropriate IAM roles for accessing the required resources.

  4. D

    Configure an AWS IAM role with a trust policy to allow Google Cloud to assume the role.

  5. E

    Set up a federation configuration in AWS to map Google Cloud service accounts to AWS IAM users.

Show answer and explanation

Correct answers: A, C

Explanation

Workload Identity Federation allows workloads running outside Google Cloud to access GCP resources without using long-lived service account keys. The process involves creating an identity provider in Google Cloud to trust the external identity source (e.g., AWS IAM) and creating a Google Cloud service account with the required permissions. This setup ensures secure and seamless access to Google Cloud services without exposing sensitive credentials.

  • A. Correct.

    Correct: To enable Workload Identity Federation, you need to configure Google Cloud to trust the AWS identity source by creating an identity provider. This is a critical step.

  • B. Incorrect.

    Incorrect: Generating and uploading a service account key goes against best practices and does not align with the use of Workload Identity Federation, which eliminates the need for long-lived credentials.

  • C. Correct.

    Correct: A Google Cloud service account is required to interact with Google Cloud resources, and it must be assigned the appropriate IAM roles for access.

  • D. Incorrect.

    Incorrect: While AWS IAM roles are important in AWS, they are not directly configured for Google Cloud to assume the role. Instead, Workload Identity Federation is used to map AWS identities to GCP service accounts.

  • E. Incorrect.

    Incorrect: There is no need to configure a federation setup in AWS to map Google Cloud service accounts to AWS IAM users. The federation happens on the Google Cloud side by trusting the AWS identity source.

Timed practice exam

Take a Google Professional Cloud Security Engineer practice test under exam conditions

60 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

More Google Professional Cloud Security Engineer practice questions

  1. 74.Your organization is using an on-premises identity provider (IdP) to manage user authentication and...
  2. 75.You are a Cloud Security Engineer at an organization that uses an on-premises identity provider...
  3. 76.Your organization uses an external identity provider (IdP) for managing user authentication. To...
  4. 77.Your organization uses an external identity provider (IdP) to authenticate workloads running in AWS...
  5. 78.Your organization uses multiple Google Cloud services, and different teams require access to...
Back to the Google Professional Cloud Security Engineer exam dumps