Examkin

Soru

Zorluk: OrtaCreating and Managing Service Accounts

A security audit workload needs to periodically list and view all user-managed service accounts and their associated keys within a Google Cloud project named `corp-analytics-prod`. The workload must be granted only the minimum necessary permissions to view service account configurations without the ability to create, delete, modify, or impersonate any service account. Following Google Cloud security best practices and the principle of least privilege, which action should you take?

  1. Create a dedicated service account for the workload and grant it the predefined `roles/iam.serviceAccountViewer` role on the project.Cevap
  2. B
    Create a dedicated service account for the workload and grant it the primitive `roles/viewer` role on the project.
  3. C
    Create a dedicated service account, grant it the `roles/iam.serviceAccountAdmin` role at the project level, and define a deny policy at the folder level to restrict modification actions.
  4. D
    Create a dedicated service account, grant it the `roles/iam.serviceAccountKeyAdmin` role on the project, and download a service account JSON key file for local authentication.

Cevap

Create a dedicated service account for the workload and grant it the predefined `roles/iam.serviceAccountViewer` role on the project.
The correct option grants the predefined role `roles/iam.serviceAccountViewer` to the dedicated service account. This predefined role includes the specific read-only permissions (`iam.serviceAccounts.get`, `iam.serviceAccounts.list`, `iam.serviceAccountKeys.get`, `iam.serviceAccountKeys.list`) required to audit service account configurations while preventing any modifications, key creations, or impersonation actions.

Adım Adım Çözüm

1
Identify the specific access requirements for the workload.
The workload requires read-only access to inspect service accounts and service account keys in the project, with no management or impersonation rights.
Security guidelines dictate granting only the exact permissions needed to perform the required task.
2
Evaluate Google Cloud Identity and Access Management (IAM) roles against the least privilege principle.
The `roles/iam.serviceAccountViewer` role provides permissions such as `iam.serviceAccounts.list`, `iam.serviceAccounts.get`, and `iam.serviceAccountKeys.list` without administrative or execution rights.
Predefined IAM roles target specific resource permissions better than broad primitive roles like Viewer or administrative roles.
3
Select the appropriate role assignment.
Assigning `roles/iam.serviceAccountViewer` to the dedicated service account at the project level fulfills the auditing requirement securely.
This enforces least privilege while satisfying all inspection requirements.

Anahtar Kavram

Least Privilege Service Account Management
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Creating and Managing Service Accounts

Bu konudan daha fazla soru