Examkin

Question

Difficulty: MediumSecrets Management and Service Account Lifecycle Security

A financial services organization is establishing an automated data ingestion pipeline from an external identity platform into Google Cloud. The security team must enforce service account lifecycle security and ensure sensitive database credentials stored in Secret Manager are protected according to Google Cloud security standards. The architecture must eliminate static service account keys, strictly enforce least privilege access, and allow key lifecycle control using Google Cloud KMS. Which TWO security controls should the architecture team implement?

  1. Configure Workload Identity Federation with the external identity provider to issue short-lived credentials for pipeline authentication instead of static service account keys.Answer
  2. Grant the service account the Secret Manager Secret Accessor role on target individual secrets and configure Secret Manager to encrypt secret versions using Cloud KMS Customer-Managed Encryption Keys (CMEK).Answer
  3. C
    Grant the pipeline service account the Service Account Admin role to allow it to generate and manage short-lived access tokens dynamically.
  4. D
    Assign the primitive Project Owner role to the pipeline service account to ensure uninterrupted access across all current and future secrets in the project.
  5. E
    Configure Customer-Supplied Encryption Keys (CSEK) within Secret Manager to maintain manual on-premises custody of raw encryption keys.

Answer

The team should configure Workload Identity Federation to eliminate service account keys, and grant the Secret Manager Secret Accessor role on specific secrets with Cloud KMS CMEK encryption.
Workload Identity Federation allows external workloads to exchange security tokens for short-lived Google Cloud access tokens, removing the need to manage long-lived service account keys. Secret Manager supports encryption using Customer-Managed Encryption Keys (CMEK) managed via Cloud KMS. Enforcing least privilege requires granting the Secret Manager Secret Accessor role on specific secrets rather than granting project-wide or administrative roles.

Step-by-Step Solution

1
Identify keyless authentication strategy for external workload.
Workload Identity Federation allows external identity providers to federate with Google Cloud IAM and receive short-lived OAuth tokens.
This eliminates the security risk of exporting and managing long-lived service account JSON keys.
2
Determine least privilege access control for Secret Manager.
Granting roles/secretmanager.secretAccessor specifically on the designated secret limits access exclusively to required payload versions.
Applying fine-grained resource-level access enforces strict IAM boundary security.
3
Select encryption control mechanism.
Configuring Customer-Managed Encryption Keys (CMEK) via Cloud KMS enables key rotation, revoking capabilities, and audit control within Google Cloud.
Secret Manager natively integrates with Cloud KMS for customer-managed envelope encryption.

Key Concept

Secrets Management and Service Account Lifecycle Security
Rate this question

Topics

Secrets Management and Service Account Lifecycle Security

More questions from this topic