Examkin

Soru

Zorluk: OrtaSecrets Management and Service Account Lifecycle Security

A security team is establishing identity and access management controls for an automated workload running on Compute Engine virtual machines in a workload project `stg-workloads`. The workload requires read access to sensitive database credentials stored in Google Cloud Secret Manager in a centralized security project `sec-mgmt`. Which of the following architectural security controls should be implemented to enforce service account lifecycle security and least privilege access? (Select TWO.)

  1. Attach a dedicated service account to the Compute Engine instances and rely on Application Default Credentials (ADC) instead of generating long-lived service account JSON keys.Cevap
  2. Grant the compute service account the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) bound directly to the target secret resource in project `sec-mgmt`.Cevap
  3. C
    Assign the primitive Editor role (`roles/editor`) on project `sec-mgmt` to the compute service account to ensure seamless API connectivity across all security services.
  4. D
    Grant the Service Account Admin role (`roles/iam.serviceAccountAdmin`) to the compute service account so it can create runtime tokens for administrative tasks.
  5. E
    Require Customer-Supplied Encryption Keys (CSEK) to encrypt secret payloads in Secret Manager to avoid using Google managed KMS key rotation.

Cevap

The correct security controls are to attach a dedicated service account to the Compute Engine instances using Application Default Credentials (ADC) rather than exporting static JSON keys, and to grant that service account the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) restricted specifically to the target secret resource.
The correct approach combines keyless authentication and resource-level role assignment. Attaching a dedicated service account to Compute Engine instances enables Application Default Credentials (ADC), eliminating service account key management overhead and exposure. Furthermore, granting the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) specifically on the target secret enforces strict least privilege across project boundaries.

Adım Adım Çözüm

1
Eliminate static credentials for service account lifecycle security.
Using metadata server authentication via Application Default Credentials (ADC) attached to the Compute Engine instance avoids creating and managing exported long-lived JSON keys.
Exported keys present high exposure and exfiltration risks.
2
Apply resource-level IAM role bindings for least privilege access to secrets.
Granting `roles/secretmanager.secretAccessor` at the specific secret resource level in project `sec-mgmt` ensures the instance can only read the designated secret payload.
Restricting roles to specific resources prevents unintended access to other secrets within the project.

Anahtar Kavram

Keyless Authentication and Least-Privilege IAM Secret Access
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Secrets Management and Service Account Lifecycle Security

Bu konudan daha fazla soru