Examkin

Question

Difficulty: MediumSecrets Management and Service Account Lifecycle Security

A security team is establishing identity and access management controls for an automated workload running on Compute Engine virtual machines in a workload project `stg-workloads`. The workload requires read access to sensitive database credentials stored in Google Cloud Secret Manager in a centralized security project `sec-mgmt`. Which of the following architectural security controls should be implemented to enforce service account lifecycle security and least privilege access? (Select TWO.)

  1. Attach a dedicated service account to the Compute Engine instances and rely on Application Default Credentials (ADC) instead of generating long-lived service account JSON keys.Answer
  2. Grant the compute service account the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) bound directly to the target secret resource in project `sec-mgmt`.Answer
  3. C
    Assign the primitive Editor role (`roles/editor`) on project `sec-mgmt` to the compute service account to ensure seamless API connectivity across all security services.
  4. D
    Grant the Service Account Admin role (`roles/iam.serviceAccountAdmin`) to the compute service account so it can create runtime tokens for administrative tasks.
  5. E
    Require Customer-Supplied Encryption Keys (CSEK) to encrypt secret payloads in Secret Manager to avoid using Google managed KMS key rotation.

Answer

The correct security controls are to attach a dedicated service account to the Compute Engine instances using Application Default Credentials (ADC) rather than exporting static JSON keys, and to grant that service account the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) restricted specifically to the target secret resource.
The correct approach combines keyless authentication and resource-level role assignment. Attaching a dedicated service account to Compute Engine instances enables Application Default Credentials (ADC), eliminating service account key management overhead and exposure. Furthermore, granting the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) specifically on the target secret enforces strict least privilege across project boundaries.

Step-by-Step Solution

1
Eliminate static credentials for service account lifecycle security.
Using metadata server authentication via Application Default Credentials (ADC) attached to the Compute Engine instance avoids creating and managing exported long-lived JSON keys.
Exported keys present high exposure and exfiltration risks.
2
Apply resource-level IAM role bindings for least privilege access to secrets.
Granting `roles/secretmanager.secretAccessor` at the specific secret resource level in project `sec-mgmt` ensures the instance can only read the designated secret payload.
Restricting roles to specific resources prevents unintended access to other secrets within the project.

Key Concept

Keyless Authentication and Least-Privilege IAM Secret Access
Estimated Time:1m 30s
Rate this question

Topics

Secrets Management and Service Account Lifecycle Security

More questions from this topic