Examkin

Question

Difficulty: HardCreating and Managing Service Accounts

A security team needs to configure cross-project permissions for a audit service account named `[email protected]` in project `finance-prod`. The security group `[email protected]` must be allowed to generate short-lived OAuth2 access tokens for this service account to run security scans without using long-lived key files. Additionally, the service account itself requires read-only access to Cloud Storage objects stored in a separate project named `finance-data`. Following Google Cloud security best practices, which TWO actions should the security team perform? (Select TWO.)

  1. Grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to group:[email protected] on the service account [email protected].Answer
  2. Grant the Storage Object Viewer role (roles/storage.objectViewer) to serviceAccount:[email protected] on project finance-data.Answer
  3. C
    Create and download a JSON service account private key file for [email protected] and distribute it to members of [email protected].
  4. D
    Grant the Editor role (roles/editor) to serviceAccount:[email protected] on project finance-data.
  5. E
    Grant the Service Account User role (roles/iam.serviceAccountUser) to group:[email protected] at the organization level so they inherit access to read objects in project finance-data.

Answer

To establish short-lived credential delegation and cross-project storage access according to Google Cloud security best practices, the administrator must grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to group:[email protected] directly on the service account resource, and grant the Storage Object Viewer role (roles/storage.objectViewer) to the service account identity on project finance-data.
To allow external identities to generate short-lived access tokens for a service account without key exports, Google Cloud requires assigning the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to the user group on the specific service account resource. Additionally, granting the predefined Storage Object Viewer role (roles/storage.objectViewer) to the service account identity on the target project satisfies least-privilege data access requirements.

Step-by-Step Solution

1
Configure Service Account Impersonation
Members of [email protected] gain permission to generate short-lived tokens for [email protected]
Assigning roles/iam.serviceAccountTokenCreator on the service account resource enables secure impersonation without exporting private keys.
2
Assign Least-Privilege Predefined Storage Role
The service account [email protected] receives read-only access to Cloud Storage objects in project finance-data
Assigning roles/storage.objectViewer on the target project provides necessary object read access without granting excessive permissions.

Key Concept

Service Account Delegation and Cross-Project Least Privilege IAM Architecture
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic