Google Professional Cloud Security Engineer exam dumps

Google Professional Cloud Security Engineer practice question 75 of 501

Professional Cloud Security Engineer. Expert level, Google Cloud. Free question with the correct answer and a full explanation.

Google Professional Cloud Security Engineer Question 75

Select 3Google Cloud Platform

You are a Cloud Security Engineer at an organization that uses an on-premises identity provider (IdP) to authenticate users. The organization wants to grant temporary access for workloads running on an on-premises Kubernetes cluster to Google Cloud resources, without using long-lived service account keys. Which of the following steps should you take to configure Workload Identity Federation to achieve this?

  1. A

    Create a workload identity pool in Google Cloud and configure a provider for your on-premises IdP.

  2. B

    Generate a long-lived service account key and store it securely in the Kubernetes cluster.

  3. C

    Grant the Google Cloud service account the necessary IAM roles to access required resources.

  4. D

    Configure the on-premises Kubernetes workloads to exchange tokens with the on-premises IdP and use the tokens to authenticate with the workload identity pool.

  5. E

    Disable Workload Identity Federation and use standard service account key authentication instead.

Show answer and explanation

Correct answers: A, C, D

Explanation

Workload Identity Federation allows you to securely authenticate workloads running outside Google Cloud (e.g., on-premises or in other clouds) to access Google Cloud resources without needing long-lived service account keys. You need to create a workload identity pool, configure a provider for your IdP, assign the appropriate IAM roles to the Google Cloud service account, and configure the workloads to authenticate using tokens provided by the IdP.

  • A. Correct.

    Correct. Creating a workload identity pool and setting up a provider for your on-premises IdP is a key step in enabling Workload Identity Federation.

  • B. Incorrect.

    Incorrect. Using long-lived service account keys is against best practices, as it increases the security risk of key exposure.

  • C. Correct.

    Correct. The Google Cloud service account must have appropriate IAM roles to access the required resources.

  • D. Correct.

    Correct. Configuring the workloads to exchange tokens with the IdP and authenticate with the workload identity pool is necessary for enabling Workload Identity Federation.

  • E. Incorrect.

    Incorrect. Disabling Workload Identity Federation negates the purpose of this setup, which is to avoid using long-lived service account keys.

Timed practice exam

Take a Google Professional Cloud Security Engineer practice test under exam conditions

60 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

More Google Professional Cloud Security Engineer practice questions

  1. 76.Your organization uses an external identity provider (IdP) for managing user authentication. To...
  2. 77.Your organization uses an external identity provider (IdP) to authenticate workloads running in AWS...
  3. 78.Your organization uses multiple Google Cloud services, and different teams require access to...
  4. 79.Your organization uses Google Cloud to manage its infrastructure. A development team needs...
  5. 80.Your organization uses Google Cloud to manage its infrastructure. A developer team needs temporary...
Back to the Google Professional Cloud Security Engineer exam dumps