Discuss Google Professional Cloud Security Engineer Exam Topic 4 Question 88

You are developing a new application that uses exclusively Compute Engine VMs Once a day. this application will execute five different batch jobs Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principle

What should you do?

A1. Create a general service account **g-sa' to execute the batch jobs.
* 2 Grant the permissions required to execute the batch jobs to g-sa.
* 3. Execute the batch jobs with the permissions granted to g-sa

B1. Create a general service account 'g-sa' to orchestrate the batch jobs.
* 2. Create one service account per batch job Mb-sa-[1-5],' and grant only the permissions required to run the individual batch jobs to the service accounts.
* 3. Grant the Service Account Token Creator role to g-sa Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5].

C1. Create a workload identity pool and configure workload identity pool providers for each batch job
* 2 Assign the workload identity user role to each of the identities configured in the providers.
* 3. Create one service account per batch job Mb-sa-[1-5]'. and grant only the permissions required to run the individual batch jobs to the service accounts
* 4 Generate credential configuration files for each of the providers Use these files to execute the batch jobs with the permissions of b-sa-[1-5].
D.
* 1. Create a general service account 'g-sa' to orchestrate the batch jobs.
* 2 Create one service account per batch job 'b-sa-[1-5)\ Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts
* 3. Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5].

Suggested Answer: B

Get Premium Professional Cloud Security Engineer Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

37 comments · newest first

Berry 11 months ago

B is definitely the way to go for managing permissions effectively.

Bobbye 11 months ago

A is too broad; we need more specific permissions.

Chantay 11 months ago

Surprised that D suggests storing keys in Secret Manager.

Derrick 11 months ago

I disagree, C has better security with workload identity.

Beatriz 12 months ago

Option B seems like the best choice for least privilege.

Lorenza 12 months ago

I feel like option D might be risky since it involves generating service account keys. I remember we talked about avoiding long-lived credentials.

Marylin 1 year ago

I’m a bit confused about the workload identity pool in option C. I don’t recall how that works in relation to service accounts.

Kimbery 1 year ago

I think option B sounds familiar because it involves creating separate service accounts for each job, which seems like a good way to limit permissions.

Nilsa 1 year ago

I remember we discussed the importance of the least-privilege principle in our last class, but I'm not sure which option best implements that here.

Hermila 1 year ago

I think option B is the way to go. Creating individual service accounts for each batch job and using a general service account to orchestrate them seems like the most straightforward and secure approach.

Gracia 1 year ago

I like the idea of using Secret Manager to store the service account keys in option D. That adds an extra layer of security, and it's still following the least-privilege principle.

Joaquin 1 year ago

I'm a bit confused about the workload identity pool option. Can that really be the most secure approach here? I'm not sure I fully understand how that would work.

Leonardo 1 year ago

This question seems straightforward, but I want to make sure I understand the requirements correctly. Adhering to the least-privilege principle is key here.

Gail 1 year ago

Okay, let me think this through. We need to design a secure access concept for the batch jobs, and the question mentions using service accounts. I'm leaning towards option B, as it seems to follow the least-privilege principle.

Clare 1 year ago

I'm a little unsure about this question. There are a few different approaches, and I want to make sure I understand the implications of each one. I'll need to carefully review the options and think through the potential pros and cons before making a decision.

Quentin 2 years ago

I'm just glad they didn't include an option that involves manually editing a 500-line YAML file. That's the kind of thing that keeps me up at night.

Darell 2 years ago

Is it just me, or does this question sound like it was written by a robot? I'm half-expecting the correct answer to be 'All of the above'.

Raylene 2 years ago

I prefer option D. Storing service account keys in Secret Manager adds an extra layer of security.

Melissa 2 years ago

Option D with the service account keys stored in Secret Manager is an interesting approach, but it feels a bit more complex than the other options. I'm not sure it's necessary for this use case.

Olga 2 years ago

↳ replying to Melissa

Option D does seem a bit complex with storing service account keys in Secret Manager, but it could provide an extra layer of security for the batch jobs.

Destiny 2 years ago

↳ replying to Melissa

I agree, Option B with individual service accounts for each batch job and using short-lived access tokens seems like a secure way to adhere to the least-privilege principle.

Emmanuel 2 years ago

↳ replying to Melissa

Option A seems like a simple solution to grant permissions to a general service account for executing batch jobs.

Rochell 2 years ago

I agree with Julene. Option B ensures least-privilege access for each batch job.

Valene 2 years ago

I like how option C uses workload identity pools to manage the permissions for each batch job. That seems like a really elegant and scalable solution.

Deeanna 2 years ago

↳ replying to Valene

I think option C is the way to go for secure access to the batch jobs.

Mose 2 years ago

↳ replying to Valene

It's definitely an elegant way to handle permissions for each batch job.

Bette 2 years ago

↳ replying to Valene

I agree, using workload identity pools seems like a scalable solution for managing permissions.

Mattie 2 years ago

↳ replying to Valene

Option C sounds like a great choice for managing permissions with workload identity pools.

Nicholle 2 years ago

↳ replying to Valene

It's important to follow the least-privilege principle when designing access for batch jobs. Option C seems to do that effectively.

Sabra 2 years ago

↳ replying to Valene

I agree, using workload identity pools seems like a secure and scalable solution for managing permissions.

Precious 2 years ago

↳ replying to Valene

Option C is indeed a great choice. Workload identity pools make it easy to manage permissions for each batch job.

Julianna 2 years ago

Option B looks like the way to go. Creating individual service accounts for each batch job and using a general service account to orchestrate them seems like a good way to follow the least-privilege principle.

Anastacia 2 years ago

↳ replying to Julianna

Using a general service account to obtain short-lived access tokens for the individual batch job service accounts adds an extra layer of security to the process.

Veronica 2 years ago

↳ replying to Julianna

It's a good practice to limit access to only what is needed for each job. This way, you reduce the risk of unauthorized access to other resources.

Abraham 2 years ago

↳ replying to Julianna

I agree, having separate service accounts for each batch job ensures that only the necessary permissions are granted for each specific task.

Herschel 2 years ago

↳ replying to Julianna

Julene 2 years ago

I think option B is the best choice. It allows for individual permissions for each batch job.

Google Professional Cloud Security Engineer Exam - Topic 4 Question 88 Discussion