Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ281

Configuring access

A company’s application is deployed using a user-managed Service Account key. You want to follow Google-recommended practices to rotate this key.

What should you do?

  • A Open Cloud Shell and run gcloud iam service-accounts enable-auto-rotate --iam-account=IAM_ACCOUNT.
  • B Open Cloud Shell and run gcloud iam service-accounts keys rotate --iam-account=IAM_ACCOUNT --key=NEW_KEY.
  • C Create a new key, and use the new key in the application. Delete the old key from the Service Account.
  • D Create a new key, and use the new key in the application. Store the old key on the system as a backup key.
Explanation

Google Cloud’s recommended rotation process for user-managed service account keys is to create a new key for the same service account, update the application to use the new key, and delete the replaced key after confirming it is no longer needed. This minimizes the period during which an old credential remains valid.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!