1.2 Managing Service Accounts PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which statement correctly differentiates a service account from a user account in Google Cloud?

   • AService accounts are automatically deleted when the project is deleted, while user accounts persist.
   • BService accounts are used only for Google Workspace users, while user accounts are used for all other identities.
   • CService accounts have no passwords and authenticate using keys or workload identity, while user accounts authenticate with passwords and MFA.
   • DService accounts can only be used within a single project, while user accounts can access resources across projects.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a primary security risk associated with default service accounts in Google Cloud?

   • AThey are shared across all projects in the organization, allowing cross-project access.
   • BThey cannot be disabled, so they are always a potential attack vector.
   • CThey are automatically deleted after 90 days of inactivity.
   • DThey are granted broad IAM roles like Editor by default, which can lead to excessive permissions.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A startup has been using the default Compute Engine service account for all its VMs. An audit reveals that this service account has the Editor role on the project, and several instances are running with this account. The security team wants to reduce the risk of this over-permissioned account being compromised. What should you do first?

   • ARotate the keys of the default service account immediately.
   • BDelete the default service account and recreate it with the same name.
   • CDisable the default service account and create a new service account with least-privilege roles for each workload.
   • DGrant the default service account the Viewer role instead of Editor.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A service account key is suspected to have been exposed in a public code repository. What is the immediate mitigation step?

   • ARotate the key by deleting it and creating a new one.
   • BDisable the service account.
   • CMonitor the key usage for suspicious activity.
   • DChange the IAM roles of the service account.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What IAM role or permission allows a user to impersonate a service account?

   • Aroles/iam.workloadIdentityUser
   • Broles/iam.securityReviewer
   • Croles/iam.serviceAccountUser
   • Droles/iam.serviceAccountAdmin
   Reveal Solution Discussion Select an answer first