Discuss Google Professional Cloud DevOps Engineer Exam Topic 5 Question 76

A third-party application needs to have a service account key to work properly When you try to export the key from your cloud project you receive an error "The organization policy constraint larn.disableServiceAccountKeyCreation is enforcedM You need to make the third-party application work while following Google-recommended security practices What should you do?

AEnable the default service account key. and download the key

BRemove the iam.disableServiceAccountKeyCreation policy at the organization level, and create a key.

CDisable the service account key creation policy at the project's folder, and download the default key

DAdd a rule to set the iam.disableServiceAccountKeyCreation policy to off in your project and create a key.

Suggested Answer: C

The correct answer is C)

Confirming that the Jenkins VM instance has an attached service account with the appropriate Identity and Access Management (IAM) permissions is the best way to ensure that the Terraform Jenkins instance is authorized to create Google Cloud resources. This follows the Google-recommended practice of using service accounts to authenticate and authorize applications running on Google Cloud1. Service accounts are associated with private keys that can be used to generate access tokens for Google Cloud APIs2. By attaching a service account to the Jenkins VM instance, Terraform can use the Application Default Credentials (ADC) strategy to automatically find and use the service account credentials3.

Answer A is incorrect because the auth application-default command is used to obtain user credentials, not service account credentials. User credentials are not recommended for applications running on Google Cloud, as they are less secure and less scalable than service account credentials1.

Answer B is incorrect because it involves downloading and copying the secret key value of the service account, which is not a secure or reliable way of managing credentials. The secret key value should be kept private and not exposed to any other system or user2. Moreover, setting the GOOGLE environment variable on the Jenkins server is not a valid way of providing credentials to Terraform. Terraform expects the credentials to be either in a file pointed by the GOOGLE_APPLICATION_CREDENTIALS environment variable, or in a provider block with the credentials argument3.

Answer D is incorrect because it involves using the Terraform module for Secret Manager, which is a service that stores and manages sensitive data such as API keys, passwords, and certificates. While Secret Manager can be used to store and retrieve credentials, it is not necessary or sufficient for authorizing the Terraform Jenkins instance. The Terraform Jenkins instance still needs a service account with the appropriate IAM permissions to access Secret Manager and other Google Cloud resources.

Get Premium Professional Cloud DevOps Engineer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

50 comments · newest first

Margart 11 months ago

Removing the policy sounds like a bad idea.

Twana 11 months ago

Wait, can you really just change the policy like that?

Lucia 11 months ago

I thought disabling policies was risky?

Kara 11 months ago

Definitely go with option D! Makes the most sense.

Lynelle 12 months ago

You can't create service account keys if the policy is enforced.

Leila 12 months ago

I’m a bit confused about the organization policy. I thought we couldn’t just change it at the project level without affecting other projects.

Reiko 1 year ago

I feel like enabling the default service account key might not be the best practice. We should avoid using default keys if possible, right?

Brynn 1 year ago

I think option D sounds familiar from a practice question we did. It might be the right way to adjust the policy without compromising security.

Vivienne 1 year ago

I remember studying about service account keys, but I'm not sure if we should just remove the policy entirely. That seems risky.

Arthur 1 year ago

I'm a bit confused about the difference between disabling the policy at the project's folder versus adding a rule to set it to off in the project. I'll need to research the best way to approach this.

Dexter 1 year ago

Okay, I think the key is to remove the policy at the organization level and then create a new key. That seems like the most straightforward approach while still following the security guidelines.

Ronna 1 year ago

Hmm, the policy constraint is enforced, so I'm not sure if I can just enable the default service account key. I'll have to look into how to remove or disable that policy.

Jess 1 year ago

This seems like a tricky one. I'll need to carefully read through the options and think about the recommended security practices.

Blossom 1 year ago

The COBIT 2019 Design Guide sounds like it might be the right answer, since it's focused on designing the governance solution. I'll double-check the details, but that's my initial thought.

Kendra 1 year ago

I'm feeling like a spy trying to bypass Google's security measures. But B seems like the stealthiest move. Shh, don't tell the admins!

Sherrell 1 year ago

↳ replying to Kendra

C: Agreed, let's keep it low-key and follow Google's security practices.

Samuel 1 year ago

↳ replying to Kendra

B: No, that might raise suspicion. I think we should go with option B.

Georgeanna 1 year ago

↳ replying to Kendra

A: Have you tried reaching out to the admins for assistance?

Elouise 1 year ago

This question is a real head-scratcher. I'm tempted to go with D, but I think B is the way to go. Gotta love Google's policy shenanigans!

Serina 1 year ago

Ha! The exam writers are really testing our understanding of Google's security practices. I'll go with B - it's the one that aligns best with their recommendations.

Bok 1 year ago

Option C looks tempting, but disabling the policy at the project level might not be the best approach. I'd go with B.

Annabelle 1 year ago

↳ replying to Bok

Let's go with Option B to make sure the third-party application works securely.

Simona 1 year ago

↳ replying to Bok

I think it's better to follow Google's recommendations and go with Option B.

Ernie 1 year ago

↳ replying to Bok

Let's go with option B to make sure we're keeping the third-party application secure.

Titus 1 year ago

↳ replying to Bok

Option B seems like the safer choice to ensure security practices are followed.

Emogene 1 year ago

↳ replying to Bok

Yeah, I think it's better to follow Google's security practices and not disable the policy.

Alyssa 1 year ago

↳ replying to Bok

I agree, option B seems like the safer choice in this situation.

Sylvie 1 year ago

↳ replying to Bok

I agree, disabling the policy at the project level could have unintended consequences.

Cordelia 1 year ago

I think the answer is B. Removing the policy at the organization level seems like the most straightforward solution to allow key creation.

Audry 1 year ago

↳ replying to Cordelia

You could try reaching out to Google support for guidance on how to proceed.

Trevor 1 year ago

↳ replying to Cordelia

But wouldn't that compromise security? Maybe there's another way to make it work.

Merilyn 1 year ago

↳ replying to Cordelia

I agree, removing the policy at the organization level should solve the issue.

Twana 1 year ago

I'm feeling like a spy trying to bypass Google's security measures. But B seems like the stealthiest move. Shh, don't tell the admins!

Kris 1 year ago

This question is a real head-scratcher. I'm tempted to go with D, but I think B is the way to go. Gotta love Google's policy shenanigans!

Rickie 1 year ago

↳ replying to Kris

Yeah, Google's policies can be tricky to navigate sometimes.

Scarlet 1 year ago

↳ replying to Kris

Let's go with B then, better to follow Google's security practices.

Lyla 1 year ago

↳ replying to Kris

I agree, D seems tempting but B is the safer option.

Rikki 1 year ago

↳ replying to Kris

I think B is the way to go.

Daniela 2 years ago

Ha! The exam writers are really testing our understanding of Google's security practices. I'll go with B - it's the one that aligns best with their recommendations.

Matt 1 year ago

↳ replying to Daniela

User 2: Yeah, I agree. Let's go with B and remove the policy at the organization level.

Corinne 1 year ago

↳ replying to Daniela

User 1: I think B is the best option too. It aligns with Google's security practices.

Bette 2 years ago

But wouldn't it be better to add a rule to turn off the policy and create a key?

Shoshana 2 years ago

Option C looks tempting, but disabling the policy at the project level might not be the best approach. I'd go with B.

Phuong 1 year ago

↳ replying to Shoshana

I agree, let's go with option B to ensure we follow Google-recommended security practices.

Gennie 1 year ago

↳ replying to Shoshana

I see your point, but removing the organization policy constraint with option B seems like the safer choice.

Corinne 1 year ago

↳ replying to Shoshana

But wouldn't it be better to enable the default service account key with option A?

Denny 1 year ago

↳ replying to Shoshana

I think B is the best option here.

Fabiola 2 years ago

I agree with Leigha, it's the safest option to follow Google's security practices.

Lemuel 2 years ago

I think the answer is B. Removing the policy at the organization level seems like the most straightforward solution to allow key creation.

Leigha 2 years ago

I think we should enable the default service account key and download it.

Google Professional Cloud DevOps Engineer Exam - Topic 5 Question 76 Discussion