Exam Professional-Cloud-Security-Engineer Topic 3 Question 10 Discussion
Actual exam question for Google's Professional-Cloud-Security-Engineer exam
Question #: 10
Topic #: 3
Question #: 10
Topic #: 3
You're developing the incident response plan for your company. You need to define the access strategy that your DevOps team will use when reviewing and investigating a deployment issue in your Google Cloud environment. There are two main requirements:
Least-privilege access must be enforced at all times.
The DevOps team must be able to access the required resources only during the deployment issue.
How should you grant access while following Google-recommended best practices?
Least-privilege access must be enforced at all times.
The DevOps team must be able to access the required resources only during the deployment issue.
How should you grant access while following Google-recommended best practices?
Suggested Answer: D Vote an answer
To ensure least-privilege access and provide necessary permissions to the DevOps team only during a deployment issue, follow these steps:
Create a Service Account:
In your Google Cloud project, create a new service account specifically for the DevOps team.
Assign Limited Permissions:
Grant the service account permissions with only the necessary list/view roles. For instance, you can create a custom IAM role with compute.instances.list and compute.instances.get permissions.
Grant Service Account User Role:
Assign the Service Account User role to the DevOps team members for the created service account. This allows them to act as the service account and use its permissions.
Access Control During Incidents:
During a deployment issue, the DevOps team can temporarily use the service account to access the resources. This ensures they have the least-privilege access required to investigate and resolve the issue.
Automation and Monitoring:
Implement automation to enable and disable the service account access as needed and monitor the usage to ensure compliance with the least-privilege principle.
Benefits:
Security: Limits access to only what is necessary, reducing the risk of unauthorized changes.
Flexibility: Provides necessary access during incidents without granting permanent elevated permissions.
Reference:
Creating and Managing Service Accounts
Service Account User Role
Create a Service Account:
In your Google Cloud project, create a new service account specifically for the DevOps team.
Assign Limited Permissions:
Grant the service account permissions with only the necessary list/view roles. For instance, you can create a custom IAM role with compute.instances.list and compute.instances.get permissions.
Grant Service Account User Role:
Assign the Service Account User role to the DevOps team members for the created service account. This allows them to act as the service account and use its permissions.
Access Control During Incidents:
During a deployment issue, the DevOps team can temporarily use the service account to access the resources. This ensures they have the least-privilege access required to investigate and resolve the issue.
Automation and Monitoring:
Implement automation to enable and disable the service account access as needed and monitor the usage to ensure compliance with the least-privilege principle.
Benefits:
Security: Limits access to only what is necessary, reducing the risk of unauthorized changes.
Flexibility: Provides necessary access during incidents without granting permanent elevated permissions.
Reference:
Creating and Managing Service Accounts
Service Account User Role
by Roberta at Sep 13, 2026, 12:29 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).