Professional Cloud Security Engineer · Free Practice Question Medium
Question 4
For a corporate wellness platform, how can an application running on a Compute Engine instance securely access data from a Cloud Storage bucket while adhering to the principle of least privilege and not allowing global access to the bucket?
- A To obtain the credentials from the instance metadata, utilize a service account that has only read permissions to the Cloud Storage bucket.
- B To secure the data in the Cloud Storage bucket, apply encryption via Cloud KMS, and permit the application to perform decryption operations utilizing the KMS key.
- C To enable the application to access a Cloud Storage bucket without requiring credentials, while only allowing read-only access from the Compute Engine instance's IP address, you can set up a Cloud Storage ACL.
- D To access the Cloud Storage bucket, utilize a service account with only read permissions, and save the service account credentials in the Compute Engine instance's application configuration.
Reveal correct answer
Correct answer: A
Explanation
The answer is correct because it recommends using a service account to access the Cloud Storage bucket securely while adhering to the principle of least privilege. A service account is a Google Cloud identity that is used to perform automated tasks, such as accessing data in a Cloud Storage bucket. By using a service account with read-only access to the Cloud Storage bucket, the application running on the Compute Engine instance can securely access the data without allowing global access to the bucket. This ensures that the application can only access the data it needs, and not any other data in the bucket, which is in line with the principle of least privilege. In addition, the answer suggests retrieving the credentials from the instance metadata, which is a secure way to provide access to the service account. The instance metadata provides information about the Compute Engine instance, including its service account and its access scopes. By retrieving the credentials from the instance metadata, the application can securely access the Cloud Storage bucket without exposing the credentials to potential attackers. Overall, using a service account with read-only access to the Cloud Storage bucket and retrieving the credentials from the instance metadata is a secure and least-privileged way to allow an application running on a Compute Engine instance to access data from a Cloud Storage bucket.Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
You must be logged in to post a comment.
