Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
A security engineer is establishing access governance for automated multi-cloud pipelines and internal workloads that deploy infrastructure into Google Cloud. The architecture must satisfy the following security requirements:
Which set of actions should the security engineer implement?
This architecture combines Google Cloud Organization Policy constraints, Workload Identity Federation, and resource-level IAM role bindings to establish secure credential delegation and completely remove static keys.
StudyCerts
StudyCertsconstraints/iam.disableServiceAccountKeyCreation Organization Policy at the root or folder level strictly prevents administrators and developers from creating new user-managed JSON or P12 service account private keys.roles/iam.serviceAccountTokenCreator) role directly on individual target service accounts (instead of at the project or organization level) allows designated callers to impersonate the target service account and mint short-lived OAuth 2.0 access tokens with granular scope.roles/iam.serviceAccountTokenCreator on the specific service account resource prevents calling principals from impersonating all other service accounts within the project.This approach aligns with Google Cloud's security best practices by replacing long-lived credentials with short-lived tokens, enforcing organizational guardrails, and scoping impersonation authority to specific service account resources.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.