Professional Cloud Security Engineer · Free Practice Question Hard
Question 5
As an Online education platform company, you need to develop an internal App Engine application that can access a user's Google Drive without relying on current user credentials, while following Google's recommended practices. What steps should you take to accomplish this using Google Cloud Services?
- A Generate a fresh Service account and assign Service Account User role to all the users of the application.
- B To grant access to all application users, a new Service account should be created and a Google Group should be created and all application users should be added to this group. Then, grant the Service Account User role to this group.
- C To impersonate the user, you should create a new service account and provide it G Suite domain-wide delegation, which the application can use.
- D To ensure secure operations of the application, it is recommended to use a separate G Suite Admin account and authenticate the application's activities using these credentials.
Reveal correct answer
Correct answer: C
Explanation
The answer is correct because Google recommends using a service account with G Suite domain-wide delegation to access a user's Google Drive without relying on current user credentials. A service account is a special account that belongs to an application or a virtual machine (VM) instead of to an individual end-user. Service accounts are typically used by applications to access other Google Cloud services, such as Google Drive, without requiring user authentication. G Suite domain-wide delegation allows a service account to access all the resources of a G Suite domain, including all the Google Drive files of users in the domain. By granting a service account domain-wide delegation, you can authorize the application to impersonate the user, which means that the application can act on behalf of the user without the user having to grant explicit permission every time. Therefore, creating a new service account and granting it G Suite domain-wide delegation is the correct approach to accomplish the task of accessing a user's Google Drive without relying on current user credentials, while following Google's recommended practices.Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
You must be logged in to post a comment.
