Examkin

Question

Difficulty: EasyCreating and Managing Service Accounts

A developer requests a service account JSON key file to authenticate an application running on a Compute Engine virtual machine instance to BigQuery. Following Google Cloud security best practices, which approach should you take to provide authentication for the application?

  1. Attach a custom service account with the necessary predefined BigQuery roles directly to the Compute Engine instance.Answer
  2. B
    Generate a new service account JSON key file and upload it to the Compute Engine instance's local file system.
  3. C
    Grant the primitive Owner role to the Compute Engine default service account and store its default key in the application configuration.
  4. D
    Enable the BigQuery API at the organization level and download the organization root service account credentials.

Answer

Attach a custom service account with the necessary predefined BigQuery roles directly to the Compute Engine instance.
Attaching a custom service account directly to a Compute Engine instance allows applications to retrieve access tokens automatically via the internal metadata server. This eliminates the need to generate, store, or rotate service account JSON keys, adhering strictly to Google Cloud security best practices.

Step-by-Step Solution

1
Identify the environment and workload context
The application runs internally on a Compute Engine virtual machine instance within Google Cloud.
Internal GCP workloads do not require exported security keys for authentication.
2
Apply Google Cloud IAM best practices for service account management
Use instance metadata authentication by assigning a custom service account with least-privilege predefined roles.
Attached service accounts leverage automatically managed short-lived tokens, eliminating the maintenance and leak risk of long-lived service account JSON keys.

Key Concept

Service Account Attachment vs. Key File Export
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic