Examkin

Soru

Zorluk: OrtaCreating and Managing Service Accounts

A security compliance team needs to provide access for an external vulnerability scanner running in an on-premises data center. The scanner must read compute instance details within the project `sec-ops-prod`. Which strategy should the team implement to adhere to Google Cloud security best practices?

  1. Create a user-managed service account, grant it the Compute Viewer (roles/compute.viewer) predefined role on the project, and configure Workload Identity Federation for keyless authentication.Cevap
  2. B
    Create a user-managed service account, grant it the Compute Viewer (roles/compute.viewer) predefined role on the project, and export a service account JSON key file to authenticate the scanner.
  3. C
    Create a user-managed service account, grant it the Editor primitive role on the project, and configure Workload Identity Federation for keyless authentication.
  4. D
    Grant the Compute Viewer (roles/compute.viewer) role at the organization level to the service account, and rely on resource hierarchy inheritance to grant access to the project.

Cevap

Create a user-managed service account, grant it the Compute Viewer (roles/compute.viewer) predefined role on the project, and configure Workload Identity Federation for keyless authentication.
The recommended security approach for on-premises or external workloads accessing Google Cloud resources is to create a dedicated user-managed service account, grant the minimal predefined IAM role (roles/compute.viewer) restricted to the target project scope, and authenticate using Workload Identity Federation to avoid managing service account JSON keys.

Adım Adım Çözüm

1
Identify identity management requirements for external workloads
Workload Identity Federation should be selected over static service account JSON keys to enable keyless authentication from external environments.
Service account keys create security risks due to long life spans and potential leaks.
2
Select the appropriate IAM role adhering to least privilege
Assign the predefined role roles/compute.viewer rather than a broad primitive role like Editor or granting access at the organization level.
Predefined roles limit access to the specific resources and permissions needed by the workload.

Anahtar Kavram

Creating service accounts with predefined roles and keyless authentication via Workload Identity Federation
Bu soruyu puanla

Konular

Creating and Managing Service Accounts

Bu konudan daha fazla soru