Professional Cloud ArchitectDemo

By Google · Question Mode

QuestionQ31

Designing for security and compliance

Mountkirk Games needs to secure connectivity from its new gaming application platform to Google Cloud. You want to simplify the process while following Google-recommended practices. What should you do?

  • A Configure Workload Identity and service accounts to be used by the application platform.
  • B Use Kubernetes Secrets, which are obfuscated by default. Configure these Secrets to be used by the application platform.
  • C Configure Kubernetes Secrets to store the secret, enable Application-Layer Secrets Encryption, and use Cloud Key Management Service (Cloud KMS) to manage the encryption keys. Configure these Secrets to be used by the application platform.
  • D Configure HashiCorp Vault on Compute Engine, and use customer managed encryption keys and Cloud Key Management Service (Cloud KMS) to manage the encryption keys. Configure these Secrets to be used by the application platform.
Explanation

Workload Identity Federation for GKE lets Kubernetes workloads authenticate to Google Cloud through Kubernetes and IAM service accounts, using short-lived credentials and fine-grained IAM permissions. It avoids storing and managing service-account keys in Kubernetes Secrets, making it the recommended, streamlined authentication method for GKE workloads accessing Google Cloud services.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!