Discuss Google Professional Cloud Security Engineer Exam Topic 1 Question 116

Your organization is using GitHub Actions as a continuous integration and delivery (Cl/CD) platform. You must enable access to Google Cloud resources from the Cl/CD pipelines in the most secure way.

What should you do?

ACreate a service account key and add it to the GitHub pipeline configuration file.

BCreate a service account key and add it to the GitHub repository content.

CConfigure a Google Kubernetes Engine cluster that uses Workload Identity to supply credentials to GitHub.

DConfigure workload identity federation to use GitHub as an identity pool provider.

Suggested Answer: D

Challenge:

Ensuring secure access to Google Cloud resources from GitHub Actions CI/CD pipelines without directly managing service account keys.

Workload Identity Federation:

Allows for the delegation of access to Google Cloud resources based on federated identities, such as those from GitHub.

Benefits:

This approach eliminates the need to manage service account keys, reducing the risk of key leakage.

It leverages GitHub's identity provider capabilities to authenticate and authorize access.

Steps to Configure Workload Identity Federation:

Step 1: Create a workload identity pool in Google Cloud.

Step 2: Add GitHub as an identity provider within the pool.

Step 3: Configure the necessary permissions and bindings for the identity pool to allow GitHub Actions to access Google Cloud resources.

Step 4: Update the GitHub Actions workflow to use the identity federation for authentication.

Workload Identity Federation

Configuring Workload Identity Federation with GitHub

Get Premium Professional Cloud Security Engineer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

26 comments · newest first

Jaleesa 2 days ago

I think option D is the best choice. It’s secure and integrates well with GitHub.

Erasmo 8 days ago

But C is more complex. D is simpler and safer.

Vincent 13 days ago

I’m leaning towards C. Kubernetes is powerful.

Felix 18 days ago

I like D as well. It integrates well with GitHub.

Leota 23 days ago

Exactly! D minimizes the risk of credential leaks.

Alonso 28 days ago

I feel like A and B are too risky. Keys can be exposed easily.

Herminia 1 month ago

Option C sounds good too, but D feels more secure.

Lawanda 1 month ago

I agree! Workload identity federation is the way to go.

Shawnta 1 month ago

I think option D is the best choice. Secure and modern.

Fatima 2 months ago

True, but security is worth the effort in the long run.

Rickie 2 months ago

I just worry about the setup time for D.

Lavera 2 months ago

Plus, it integrates well with GitHub. Makes sense!

Reena 2 months ago

Exactly! D minimizes risk by not using static keys.

Fatima 2 months ago

I feel like A and B are too risky. Keys can be exposed easily.

Rickie 2 months ago

Option C is good too, but a bit complex for some teams.

Lavera 3 months ago

I agree, D seems to leverage existing identity management.

Reena 3 months ago

I think option D is the best choice. Secure and efficient.

Sanjuana 3 months ago

I’m not sure about D, sounds complicated.

Chandra 3 months ago

Totally agree with D, it's more secure!

Basilia 3 months ago

Wait, isn't using service account keys risky?

Lawrence 4 months ago

I think C is a solid option too.

Dean 4 months ago

Option D is the best choice for security!

Lili 4 months ago

I vaguely recall that using identity pools can help with security, but I need to double-check how it integrates with GitHub Actions.

Stephaine 5 months ago

I'm not entirely sure, but I feel like using Workload Identity with GKE might be more complex than just setting up a service account.

Gearldine 6 months ago

I think workload identity federation was mentioned in a practice question. It sounds like a secure way to manage access without exposing keys.

Dick 6 months ago

I remember we discussed the importance of not hardcoding credentials in CI/CD pipelines, so options A and B seem risky.

Google Professional Cloud Security Engineer Exam - Topic 1 Question 116 Discussion