Examkin

Soru

Zorluk: KolayCreating and Managing Service Accounts

You are deploying a custom web application on a Compute Engine instance that needs to fetch static files from Cloud Storage and record application logs in Cloud Logging. Following Google Cloud security best practices for service account creation and management, which TWO steps should you take to grant the required permissions? (Select TWO)

  1. Provision a dedicated service account using the gcloud iam service-accounts create command.Cevap
  2. Grant the predefined roles roles/storage.objectViewer and roles/logging.logWriter directly to the service account.Cevap
  3. C
    Generate a private JSON key file for the service account and upload it to the virtual machine local disk for application authentication.
  4. D
    Grant the primitive Editor role to the service account at the project level to simplify permission management.
  5. E
    Enable the Cloud Storage API at the Google Cloud organization level rather than within the specific project hosting the application.

Cevap

Create a dedicated service account using gcloud CLI and assign least-privilege predefined roles (roles/storage.objectViewer and roles/logging.logWriter) to it.
The correct approach involves creating a dedicated custom service account and assigning specific predefined IAM roles (`roles/storage.objectViewer` and `roles/logging.logWriter`). Compute Engine instances automatically authenticate workloads using attached service accounts via the metadata server, eliminating the need to store sensitive private key files on disk.

Adım Adım Çözüm

1
Create a dedicated service account using the CLI.
A new service account resource is created within the project.
Dedicated service accounts isolate application identities and prevent over-privileged access.
2
Bind predefined IAM roles to the service account.
The service account gains granular access to read Cloud Storage objects and submit logs to Cloud Logging.
Predefined roles follow the principle of least privilege.
3
Attach the service account to the Compute Engine virtual machine during provisioning.
The virtual machine uses automatically managed metadata service credentials without long-lived keys.
Inside Google Cloud, service accounts attached to VMs authenticate securely via instance metadata.

Anahtar Kavram

Creating service accounts and assigning least-privilege predefined roles for workload authentication.
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Creating and Managing Service Accounts

Bu konudan daha fazla soru