Examkin

Soru

Zorluk: OrtaCreating and Managing Service Accounts

A cloud security engineer is tasked with establishing service account governance and credential security standards across several Google Cloud projects. Which of the following administrative actions and security practices align with Google Cloud recommendations for managing service accounts? (Select TWO.)

  1. Enforce the organization policy constraint `iam.disableServiceAccountKeyCreation` to prevent users from generating static, downloadable JSON service account keys.Cevap
  2. Use service account impersonation and short-lived credentials for automated tools and pipelines instead of exporting persistent key files.Cevap
  3. C
    Export JSON service account key files and save them to boot disks on Compute Engine instances to simplify application authentication.
  4. D
    Grant developers the primitive Editor role (`roles/editor`) at the project level so they can create, manage, and attach service accounts to resources.
  5. E
    Enable the Cloud IAM Service Account Credentials API at the parent organization node level rather than within individual service host projects.

Cevap

Enforcing the organization policy constraint `iam.disableServiceAccountKeyCreation` and utilizing service account impersonation with short-lived credentials represent recommended Google Cloud security practices.
Google Cloud security best practices dictate minimizing the use of long-lived service account keys by enforcing the `iam.disableServiceAccountKeyCreation` organization policy. For automated processes needing authentication, using service account impersonation generates temporary, short-lived OAuth2 access tokens or identity tokens without persisting sensitive key files.

Adım Adım Çözüm

1
Evaluate key management options
Identify that static, downloadable JSON service account keys introduce significant risk if leaked or mismanaged.
Google Cloud strongly recommends restricting static key generation via organization policies.
2
Evaluate authentication mechanism for automation
Determine that service account impersonation using IAM short-lived tokens provides secure, temporary credentials without key management overhead.
Short-lived tokens automatically expire, minimizing exposure windows.
3
Reject non-compliant IAM and infrastructure management options
Eliminate options advocating static key storage on disks, broad primitive project Editor roles, or invalid API enablement scopes.
These violate least-privilege security mandates and procedural GCP resource configuration rules.

Anahtar Kavram

Service Account Governance and Short-Lived Credentials
Bu soruyu puanla

Konular

Creating and Managing Service Accounts

Bu konudan daha fazla soru