Google Exam Professional-Cloud-Security-Engineer Topic 4 Question 88 Discussion

Actual exam question for Google's Professional Cloud Security Engineer exam

Question #: 88
Topic #: 4

[All Professional Cloud Security Engineer Questions]

You are developing a new application that uses exclusively Compute Engine VMs Once a day. this application will execute five different batch jobs Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principle

What should you do?

A1. Create a general service account **g-sa' to execute the batch jobs.
* 2 Grant the permissions required to execute the batch jobs to g-sa.
* 3. Execute the batch jobs with the permissions granted to g-sa

B1. Create a general service account 'g-sa' to orchestrate the batch jobs.
* 2. Create one service account per batch job Mb-sa-[1-5],' and grant only the permissions required to run the individual batch jobs to the service accounts.
* 3. Grant the Service Account Token Creator role to g-sa Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5].

C1. Create a workload identity pool and configure workload identity pool providers for each batch job
* 2 Assign the workload identity user role to each of the identities configured in the providers.
* 3. Create one service account per batch job Mb-sa-[1-5]'. and grant only the permissions required to run the individual batch jobs to the service accounts
* 4 Generate credential configuration files for each of the providers Use these files to execute the batch jobs with the permissions of b-sa-[1-5].
D.
* 1. Create a general service account 'g-sa' to orchestrate the batch jobs.
* 2 Create one service account per batch job 'b-sa-[1-5)\ Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts
* 3. Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5].

Show Suggested Answer

Suggested Answer: B

by Eric at Sep 14, 2024, 04:00 AM

Limited Time Offer

25%

11 days ago

I like how option C uses workload identity pools to manage the permissions for each batch job. That seems like a really elegant and scalable solution.

upvoted 0 times

Sabra

6 days ago

I agree, using workload identity pools seems like a secure and scalable solution for managing permissions.

upvoted 0 times

...

Precious

7 days ago

Option C is indeed a great choice. Workload identity pools make it easy to manage permissions for each batch job.

upvoted 0 times

...

12 days ago

upvoted 0 times

...

Julene

23 days ago

I think option B is the best choice. It allows for individual permissions for each batch job.

upvoted 0 times

...