Google Exam Professional Cloud Security Engineer Topic 3 Question 33 Discussion

Actual exam question for Google's Professional Cloud Security Engineer exam

Question #: 33
Topic #: 3

[All Professional Cloud Security Engineer Questions]

You are a Security Administrator at your organization. You need to restrict service account creation capability within production environments. You want to accomplish this centrally across the organization. What should you do?

AUse Identity and Access Management (IAM) to restrict access of all users and service accounts that have access to the production environment.

BUse organization policy constraints/iam.disableServiceAccountKeyCreation boolean to disable the creation of new service accounts.

CUse organization policy constraints/iam.disableServiceAccountKeyUpload boolean to disable the creation of new service accounts.

DUse organization policy constraints/iam.disableServiceAccountCreation boolean to disable the creation of new service accounts.

Show Suggested Answer

Suggested Answer: A, C

https://cloud.google.com/kms/docs/secret-management

by Jani at May 03, 2022, 10:35 PM

Limited Time Offer

25%

Off

Get Premium Professional Cloud Security Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Tarra

2 months ago

Option B seems like it might work, but it's a bit indirect. Why not just go for the straightforward solution in option D?

upvoted 0 times

...

Shawnee

2 months ago

Haha, option C is pretty funny. I mean, who would want to disable the ability to upload service account keys? That's just asking for trouble!

upvoted 0 times

Dorethea

5 days ago

User 3: Option C does sound risky. Disabling the ability to upload service account keys could cause issues.

upvoted 0 times

...

Eliz

8 days ago

User 2: Yeah, I agree. It's important to restrict that capability in production environments.

upvoted 0 times

...

Novella

13 days ago

User 1: I think option D is the best choice. It disables the creation of new service accounts.

upvoted 0 times

...

Merlyn

2 months ago

I'm not sure why anyone would choose option A. That's just way too broad and would restrict access for everyone, not just service accounts.

upvoted 0 times

Madonna

8 hours ago

Option D might also work, as it directly disables service account creation.

upvoted 0 times

...

Beatriz

2 days ago

Using IAM to restrict access for all users is definitely too broad.

upvoted 0 times

...

Shad

5 days ago

I agree, option B is more targeted and will only affect service account creation.

upvoted 0 times

...

Daniela

13 days ago

Option B is the best choice to specifically disable the creation of new service accounts.

upvoted 0 times

...

Brynn

16 days ago

Yeah, option A would be too broad and affect all users, not just service accounts.

upvoted 0 times

...

Tess

18 days ago

I agree, option B is more targeted and will only affect service account creation.

upvoted 0 times

...

Katy

18 days ago

I think option D is the most straightforward way to restrict service account creation.

upvoted 0 times

...

Lynelle

27 days ago

Option C could also work by disabling the creation of new service account keys.

upvoted 0 times

...

Jesse

1 months ago

I agree, option A would be too broad and affect all users.

upvoted 0 times

...

Aaron

1 months ago

Option B is the best choice to specifically disable the creation of new service accounts.

upvoted 0 times

...

Vivan

2 months ago

Option B is the best choice to disable the creation of new service accounts.

upvoted 0 times

...

Alpha

2 months ago

Option D is the correct answer. It's the only one that directly disables the creation of new service accounts, which is what the question asks for.

upvoted 0 times

Lashandra

24 days ago

I agree, let's go with option D to centrally disable service account creation.

upvoted 0 times

...

Stephaine

25 days ago

That could work too, but option D seems more direct and specific to the question.

upvoted 0 times

...

Oren

28 days ago

But what about using IAM to restrict access for all users and service accounts?

upvoted 0 times

...

Lilli

1 months ago

I think we should use option D to disable service account creation.

upvoted 0 times

...

Lewis

2 months ago

I believe option D is the correct answer, using organization policy constraints to disable service account creation.

upvoted 0 times

...

Elza

3 months ago

I agree with Vanna, using IAM would be the best way to centrally restrict service account creation.

upvoted 0 times

...

Vanna

3 months ago

I think we should use IAM to restrict access to service accounts.

upvoted 0 times

...