Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
An enterprise is refactoring its security architecture on Google Cloud to adhere to the principle of least privilege and strict separation of duties. Currently, developers run automated deployment pipelines and scheduled tasks using their personal corporate user accounts, which requires assigning them broad, standing permissions. Furthermore, developers have generated and downloaded service account JSON keys to authenticate external CI/CD runners, and they occasionally impersonate service accounts directly in production to resolve urgent incidents.
The security engineering team has established the following mandatory requirements:
Which strategy should the security engineer implement to satisfy these requirements?
This configuration allows developers to impersonate production service accounts by generating short-lived OAuth 2.0 access tokens, JSON Web Tokens (JWTs), or signed blobs via the roles/iam.serviceAccountTokenCreator role. It attempts to secure external CI/CD jobs by centralizing downloadable service account JSON key storage in Secret Manager while relying on retroactive audit logging.
roles/iam.serviceAccountTokenCreator) creates permanent elevation pathways instead of time-bound, approval-based just-in-time grants.The scenario permitted standing programmatic impersonation in non-production development environments where external identity federation was unsupported and key creation could not be disabled.
This option implements OS Login with 2-step verification to enforce multi-factor authentication when users connect to Compute Engine VM instances over SSH. It requires human operators to log into servers interactively to execute batch workloads and assigns permanent administrative roles for security management.
The primary goal were to secure interactive administrator SSH access to backend virtual machines from compromised OAuth client tokens.
This approach uses basic IAM roles (such as roles/editor) restricted by time-based IAM Conditions on human user accounts. It relies on the default Compute Engine service account for executing batch tasks and implements an operational schedule to rotate downloadable service account keys weekly.
roles/editor or roles/owner) grant extensive, unmanaged permissions across virtually all Google Cloud APIs, significantly increasing the potential blast radius.roles/editor role on the project, violating least-privilege isolation for specific workload lifecycles.The organization lacked an external identity provider and required a coarse, schedule-based restriction mechanism for basic sandbox environments without production security requirements.
This strategy aligns workload execution, credential lifecycle management, and human privileged access with modern Google Cloud security best practices. It provisions dedicated service accounts specifically scoped to application lifecycles, replaces downloadable credential files with federated OpenID Connect (OIDC) or SAML tokens via Workload Identity Federation, blocks key export across the resource hierarchy using Organization Policies, and governs emergency human access via Privileged Access Manager (PAM).
iam.disableServiceAccountKeyCreation prevents the generation of downloadable private key JSON files, while Workload Identity Federation allows external runners to exchange short-lived tokens from external Identity Providers (such as GitHub Actions or Jenkins) for short-lived Google Cloud access tokens.This approach directly resolves both identity lifecycle and credential exposure challenges. It eliminates non-human dependencies on human accounts, removes vulnerable service account key files, and establishes a governed, audited path for human emergency access.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated