Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ215

Configuring access

You intend to deploy cloud infrastructure through a CI/CD cluster hosted on Compute Engine. You want to reduce the risk that a third party steals its credentials. What should you do?

  • A Create a dedicated Cloud Identity user account for the cluster. Use a strong self-hosted vault solution to store the user's temporary credentials.
  • B Create a dedicated Cloud Identity user account for the cluster. Enable the constraints/iam.disableServiceAccountCreation organization policy at the project level.
  • C Create a custom service account for the cluster. Enable the constraints/iam.disableServiceAccountKeyCreation organization policy at the project level
  • D Create a custom service account for the cluster. Enable the constraints/iam.allowServiceAccountCredentialLifetimeExtension organization policy at the project level.
Explanation

A Compute Engine workload should authenticate using a dedicated user-managed service account attached to the instances, so it can obtain credentials without embedding user credentials or secret keys in code or configuration. Enforcing constraints/iam.disableServiceAccountKeyCreation prevents creation of external service-account keys, which are a credential-leakage risk.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!