Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Google Exam Professional Cloud DevOps Engineer Topic 5 Question 76 Discussion

Actual exam question for Google's Professional Cloud DevOps Engineer exam
Question #: 76
Topic #: 5
[All Professional Cloud DevOps Engineer Questions]

A third-party application needs to have a service account key to work properly When you try to export the key from your cloud project you receive an error "The organization policy constraint larn.disableServiceAccountKeyCreation is enforcedM You need to make the third-party application work while following Google-recommended security practices What should you do?

Show Suggested Answer Hide Answer
Suggested Answer: C

The correct answer is C)

Confirming that the Jenkins VM instance has an attached service account with the appropriate Identity and Access Management (IAM) permissions is the best way to ensure that the Terraform Jenkins instance is authorized to create Google Cloud resources. This follows the Google-recommended practice of using service accounts to authenticate and authorize applications running on Google Cloud1. Service accounts are associated with private keys that can be used to generate access tokens for Google Cloud APIs2. By attaching a service account to the Jenkins VM instance, Terraform can use the Application Default Credentials (ADC) strategy to automatically find and use the service account credentials3.

Answer A is incorrect because the auth application-default command is used to obtain user credentials, not service account credentials. User credentials are not recommended for applications running on Google Cloud, as they are less secure and less scalable than service account credentials1.

Answer B is incorrect because it involves downloading and copying the secret key value of the service account, which is not a secure or reliable way of managing credentials. The secret key value should be kept private and not exposed to any other system or user2. Moreover, setting the GOOGLE environment variable on the Jenkins server is not a valid way of providing credentials to Terraform. Terraform expects the credentials to be either in a file pointed by the GOOGLE_APPLICATION_CREDENTIALS environment variable, or in a provider block with the credentials argument3.

Answer D is incorrect because it involves using the Terraform module for Secret Manager, which is a service that stores and manages sensitive data such as API keys, passwords, and certificates. While Secret Manager can be used to store and retrieve credentials, it is not necessary or sufficient for authorizing the Terraform Jenkins instance. The Terraform Jenkins instance still needs a service account with the appropriate IAM permissions to access Secret Manager and other Google Cloud resources.


by Ling at Sep 09, 2024, 07:14 AM

Limited Time Offer

25%

Off

Get Premium Professional Cloud DevOps Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel
Kendra
10 days ago
I'm feeling like a spy trying to bypass Google's security measures. But B seems like the stealthiest move. Shh, don't tell the admins!
upvoted 0 times
...
Elouise
12 days ago
This question is a real head-scratcher. I'm tempted to go with D, but I think B is the way to go. Gotta love Google's policy shenanigans!
upvoted 0 times
...
Serina
14 days ago
Ha! The exam writers are really testing our understanding of Google's security practices. I'll go with B - it's the one that aligns best with their recommendations.
upvoted 0 times
...
Bok
17 days ago
Option C looks tempting, but disabling the policy at the project level might not be the best approach. I'd go with B.
upvoted 0 times
Sylvie
2 days ago
I agree, disabling the policy at the project level could have unintended consequences.
upvoted 0 times
...
...
Cordelia
1 months ago
I think the answer is B. Removing the policy at the organization level seems like the most straightforward solution to allow key creation.
upvoted 0 times
Audry
4 days ago
You could try reaching out to Google support for guidance on how to proceed.
upvoted 0 times
...
Trevor
22 days ago
But wouldn't that compromise security? Maybe there's another way to make it work.
upvoted 0 times
...
Merilyn
24 days ago
I agree, removing the policy at the organization level should solve the issue.
upvoted 0 times
...
...
Twana
1 months ago
I'm feeling like a spy trying to bypass Google's security measures. But B seems like the stealthiest move. Shh, don't tell the admins!
upvoted 0 times
...
Kris
1 months ago
This question is a real head-scratcher. I'm tempted to go with D, but I think B is the way to go. Gotta love Google's policy shenanigans!
upvoted 0 times
Rickie
4 days ago
Yeah, Google's policies can be tricky to navigate sometimes.
upvoted 0 times
...
Scarlet
8 days ago
Let's go with B then, better to follow Google's security practices.
upvoted 0 times
...
Lyla
30 days ago
I agree, D seems tempting but B is the safer option.
upvoted 0 times
...
Rikki
1 months ago
I think B is the way to go.
upvoted 0 times
...
...
Daniela
2 months ago
Ha! The exam writers are really testing our understanding of Google's security practices. I'll go with B - it's the one that aligns best with their recommendations.
upvoted 0 times
Matt
10 days ago
User 2: Yeah, I agree. Let's go with B and remove the policy at the organization level.
upvoted 0 times
...
Corinne
14 days ago
User 1: I think B is the best option too. It aligns with Google's security practices.
upvoted 0 times
...
...
Bette
2 months ago
But wouldn't it be better to add a rule to turn off the policy and create a key?
upvoted 0 times
...
Shoshana
2 months ago
Option C looks tempting, but disabling the policy at the project level might not be the best approach. I'd go with B.
upvoted 0 times
Phuong
6 days ago
I agree, let's go with option B to ensure we follow Google-recommended security practices.
upvoted 0 times
...
Gennie
9 days ago
I see your point, but removing the organization policy constraint with option B seems like the safer choice.
upvoted 0 times
...
Corinne
16 days ago
But wouldn't it be better to enable the default service account key with option A?
upvoted 0 times
...
Denny
24 days ago
I think B is the best option here.
upvoted 0 times
...
...
Fabiola
2 months ago
I agree with Leigha, it's the safest option to follow Google's security practices.
upvoted 0 times
...
Lemuel
2 months ago
I think the answer is B. Removing the policy at the organization level seems like the most straightforward solution to allow key creation.
upvoted 0 times
...
Leigha
2 months ago
I think we should enable the default service account key and download it.
upvoted 0 times
...

Save Cancel