Exam Professional Cloud Security Engineer topic 1 question 328 discussion

Actual exam question from Google's Professional Cloud Security Engineer

Question #: 328
Topic #: 1

[All Professional Cloud Security Engineer Questions]

Your organization’s application is being integrated with a partner application that requires read access to customer data to process customer orders. The customer data is stored in one of your Cloud Storage buckets. You have evaluated different options and determined that this activity requires the use of service account keys. You must advise the partner on how to minimize the risk of a compromised service account key causing a loss of data. What should you advise the partner to do?

A. Scan the Cloud Storage bucket with Sensitive Data Protection when new data is added, and automatically mask all customer data.
B. Define a VPC Service Controls perimeter, and restrict the Cloud Storage API. Add an ingress rule to the perimeter to allow access to the Cloud Storage API for the service account from outside of the perimeter.
C. Ensure that all data for the application that is accessed through the relevant service accounts is encrypted at rest by using customer-managed encryption keys (CMEK).
D. Implement a secret management service. Configure the service to frequently rotate the service account key. Configure proper access control to the key, and restrict who can create service account keys.

Show Suggested Answer

Suggested Answer: D 🗳️

by Tag at July 14, 2025, 5:22 a.m.

Comments

Submit Cancel

n2183712847

1 week, 2 days ago

Selected Answer: D

Rotating is the best policy/option for remediation of compromised keys.

upvoted 1 times

...

kharakbeer

2 weeks, 6 days ago

Selected Answer: D

D is correct

upvoted 1 times

...