Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Google Professional Cloud Security Engineer Exam - Topic 4 Question 88 Discussion

You are developing a new application that uses exclusively Compute Engine VMs Once a day. this application will execute five different batch jobs Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principleWhat should you do?
B) 1. Create a general service account 'g-sa' to orchestrate the batch jobs. * 2. Create one service account per batch job Mb-sa-[1-5],' and grant only the permissions required to run the individual batch jobs to the service accounts. * 3. Grant the Service Account Token Creator role to g-sa Use g-sa to obtain short-lived access tokens for b-sa-[1-5] and to execute the batch jobs with the permissions of b-sa-[1-5].
A) 1. Create a general service account **g-sa' to execute the batch jobs. * 2 Grant the permissions required to execute the batch jobs to g-sa. * 3. Execute the batch jobs with the permissions granted to g-sa
C) 1. Create a workload identity pool and configure workload identity pool providers for each batch job * 2 Assign the workload identity user role to each of the identities configured in the providers. * 3. Create one service account per batch job Mb-sa-[1-5]'. and grant only the permissions required to run the individual batch jobs to the service accounts * 4 Generate credential configuration files for each of the providers Use these files to execute the batch jobs with the permissions of b-sa-[1-5]. D. * 1. Create a general service account 'g-sa' to orchestrate the batch jobs. * 2 Create one service account per batch job 'b-sa-[1-5)\ Grant only the permissions required to run the individual batch jobs to the service accounts and generate service account keys for each of these service accounts * 3. Store the service account keys in Secret Manager. Grant g-sa access to Secret Manager and run the batch jobs with the permissions of b-sa-[1-5].

Google Professional Cloud Security Engineer Exam - Topic 4 Question 88 Discussion

Actual exam question for Google's Professional Cloud Security Engineer exam
Question #: 88
Topic #: 4
[All Professional Cloud Security Engineer Questions]

You are developing a new application that uses exclusively Compute Engine VMs Once a day. this application will execute five different batch jobs Each of the batch jobs requires a dedicated set of permissions on Google Cloud resources outside of your application. You need to design a secure access concept for the batch jobs that adheres to the least-privilege principle

What should you do?

Show Suggested Answer Hide Answer
Suggested Answer: B

by Eric at Sep 14, 2024, 04:00 AM

Limited Time Offer

25%

Off

Get Premium Professional Cloud Security Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Berry
7 months ago
B is definitely the way to go for managing permissions effectively.
upvoted 0 times
...
Bobbye
8 months ago
A is too broad; we need more specific permissions.
upvoted 0 times
...
Chantay
8 months ago
Surprised that D suggests storing keys in Secret Manager.
upvoted 0 times
...
Derrick
8 months ago
I disagree, C has better security with workload identity.
upvoted 0 times
...
Beatriz
8 months ago
Option B seems like the best choice for least privilege.
upvoted 0 times
...
Lorenza
9 months ago
I feel like option D might be risky since it involves generating service account keys. I remember we talked about avoiding long-lived credentials.
upvoted 0 times
...
Marylin
9 months ago
I’m a bit confused about the workload identity pool in option C. I don’t recall how that works in relation to service accounts.
upvoted 0 times
...
Kimbery
9 months ago
I think option B sounds familiar because it involves creating separate service accounts for each job, which seems like a good way to limit permissions.
upvoted 0 times
...
Nilsa
9 months ago
I remember we discussed the importance of the least-privilege principle in our last class, but I'm not sure which option best implements that here.
upvoted 0 times
...
Hermila
9 months ago
I think option B is the way to go. Creating individual service accounts for each batch job and using a general service account to orchestrate them seems like the most straightforward and secure approach.
upvoted 0 times
...
Gracia
9 months ago
I like the idea of using Secret Manager to store the service account keys in option D. That adds an extra layer of security, and it's still following the least-privilege principle.
upvoted 0 times
...
Joaquin
9 months ago
I'm a bit confused about the workload identity pool option. Can that really be the most secure approach here? I'm not sure I fully understand how that would work.
upvoted 0 times
...
Leonardo
9 months ago
This question seems straightforward, but I want to make sure I understand the requirements correctly. Adhering to the least-privilege principle is key here.
upvoted 0 times
...
Gail
9 months ago
Okay, let me think this through. We need to design a secure access concept for the batch jobs, and the question mentions using service accounts. I'm leaning towards option B, as it seems to follow the least-privilege principle.
upvoted 0 times
...
Clare
9 months ago
I'm a little unsure about this question. There are a few different approaches, and I want to make sure I understand the implications of each one. I'll need to carefully review the options and think through the potential pros and cons before making a decision.
upvoted 0 times
...
Quentin
2 years ago
I'm just glad they didn't include an option that involves manually editing a 500-line YAML file. That's the kind of thing that keeps me up at night.
upvoted 0 times
...
Darell
2 years ago
Is it just me, or does this question sound like it was written by a robot? I'm half-expecting the correct answer to be 'All of the above'.
upvoted 0 times
...
Raylene
2 years ago
I prefer option D. Storing service account keys in Secret Manager adds an extra layer of security.
upvoted 0 times
...
Melissa
2 years ago
Option D with the service account keys stored in Secret Manager is an interesting approach, but it feels a bit more complex than the other options. I'm not sure it's necessary for this use case.
upvoted 0 times
Olga
2 years ago
Option D does seem a bit complex with storing service account keys in Secret Manager, but it could provide an extra layer of security for the batch jobs.
upvoted 0 times
...
Destiny
2 years ago
I agree, Option B with individual service accounts for each batch job and using short-lived access tokens seems like a secure way to adhere to the least-privilege principle.
upvoted 0 times
...
Emmanuel
2 years ago
Option A seems like a simple solution to grant permissions to a general service account for executing batch jobs.
upvoted 0 times
...
...
Rochell
2 years ago
I agree with Julene. Option B ensures least-privilege access for each batch job.
upvoted 0 times
...
Valene
2 years ago
I like how option C uses workload identity pools to manage the permissions for each batch job. That seems like a really elegant and scalable solution.
upvoted 0 times
Deeanna
2 years ago
I think option C is the way to go for secure access to the batch jobs.
upvoted 0 times
...
Mose
2 years ago
It's definitely an elegant way to handle permissions for each batch job.
upvoted 0 times
...
Bette
2 years ago
I agree, using workload identity pools seems like a scalable solution for managing permissions.
upvoted 0 times
...
Mattie
2 years ago
Option C sounds like a great choice for managing permissions with workload identity pools.
upvoted 0 times
...
Nicholle
2 years ago
It's important to follow the least-privilege principle when designing access for batch jobs. Option C seems to do that effectively.
upvoted 0 times
...
Sabra
2 years ago
I agree, using workload identity pools seems like a secure and scalable solution for managing permissions.
upvoted 0 times
...
Precious
2 years ago
Option C is indeed a great choice. Workload identity pools make it easy to manage permissions for each batch job.
upvoted 0 times
...
...
Julianna
2 years ago
Option B looks like the way to go. Creating individual service accounts for each batch job and using a general service account to orchestrate them seems like a good way to follow the least-privilege principle.
upvoted 0 times
Anastacia
2 years ago
Using a general service account to obtain short-lived access tokens for the individual batch job service accounts adds an extra layer of security to the process.
upvoted 0 times
...
Veronica
2 years ago
It's a good practice to limit access to only what is needed for each job. This way, you reduce the risk of unauthorized access to other resources.
upvoted 0 times
...
Abraham
2 years ago
I agree, having separate service accounts for each batch job ensures that only the necessary permissions are granted for each specific task.
upvoted 0 times
...
Herschel
2 years ago
Option B looks like the way to go. Creating individual service accounts for each batch job and using a general service account to orchestrate them seems like a good way to follow the least-privilege principle.
upvoted 0 times
...
...
Julene
2 years ago
I think option B is the best choice. It allows for individual permissions for each batch job.
upvoted 0 times
...

Save Cancel