Examkin

Question

Difficulty: MediumSecrets Management and Service Account Lifecycle Security

An analytics platform operating on Google Compute Engine virtual machines in a production environment needs to dynamically retrieve database connection credentials stored in Secret Manager. The platform requires automated rotation of these credentials alongside a zero-trust credential posture that completely eliminates long-lived service account key files. Which TWO security controls should the architecture team implement to meet these requirements while following Google-recommended best practices? (Select TWO.)

  1. Attach a custom service account to the Compute Engine instances and grant that service account the Secret Manager Secret Accessor role on the specific secrets.Answer
  2. Configure automated rotation in Secret Manager linked to a Pub/Sub topic and a Cloud Function running under a service account with the Secret Manager Secret Version Manager role.Answer
  3. C
    Assign the Project Owner primitive role to the service account attached to the Compute Engine instances to allow seamless creation and retrieval of secret payloads.
  4. D
    Grant the service account assigned to the Compute Engine instances the Service Account Admin role so that it can dynamically rotate and regenerate its own key credentials.
  5. E
    Download service account JSON key files and store them encrypted using Customer-Supplied Encryption Keys (CSEK) inside a Cloud Storage bucket mounted to the instances.

Answer

The platform should attach a custom service account with the Secret Manager Secret Accessor role to the instances, and implement automated rotation using Secret Manager Pub/Sub topics combined with a Cloud Function granted the Secret Manager Secret Version Manager role.
Attaching a custom service account to the compute instances with the Secret Manager Secret Accessor role allows applications to securely access secrets via Application Default Credentials without using static key files. Configuring automated rotation via Pub/Sub and Cloud Functions using a dedicated service account with the Secret Version Manager role enables secure, hands-free credential rotation according to enterprise security standards.

Step-by-Step Solution

1
Eliminate service account key file dependency by attaching a workload service account
Compute Engine instances automatically obtain short-lived OAuth tokens via the Metadata Server and Application Default Credentials (ADC).
Eliminates security risks associated with long-lived exported key management.
2
Apply least-privilege IAM permissions for secret retrieval
Grant the instance service account `roles/secretmanager.secretAccessor` strictly on required secrets.
Allows applications to read secret payloads without granting unnecessary administrative permissions.
3
Configure event-driven secret rotation workflow
Secret Manager publishes rotation notifications to Pub/Sub, triggering a Cloud Function bound to a service account with `roles/secretmanager.secretVersionManager`.
Automates secret updates and lifecycle management according to compliance guidelines.

Key Concept

Service Account Lifecycle and Secret Manager Automated Rotation
Rate this question

Topics

Secrets Management and Service Account Lifecycle Security

More questions from this topic