ExamTopics Logo
Mail Us[email protected]
Menu
Google Discussions
exam questions

Exam Professional Cloud Developer All Questions

View all questions & answers for the Professional Cloud Developer exam
Go to Exam

Exam Professional Cloud Developer topic 1 question 104 discussion

Actual exam question from Google's Professional Cloud Developer
Question #: 104
Topic #: 1
[All Professional Cloud Developer Questions]

You are developing a microservice-based application that will be deployed on a Google Kubernetes Engine cluster. The application needs to read and write to a
Spanner database. You want to follow security best practices while minimizing code changes. How should you configure your application to retrieve Spanner credentials?

  • A. Configure the appropriate service accounts, and use Workload Identity to run the pods.
  • B. Store the application credentials as Kubernetes Secrets, and expose them as environment variables.
  • C. Configure the appropriate routing rules, and use a VPC-native cluster to directly connect to the database.
  • D. Store the application credentials using Cloud Key Management Service, and retrieve them whenever a database connection is made.
Show Suggested Answer Hide Answer
Suggested Answer: A 🗳️
by scaenruy at Jan. 9, 2022, 6:23 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
kinoko1330
Highly Voted 2 years, 10 months ago
Selected Answer: A
https://cloud.google.com/blog/products/containers-kubernetes/introducing-workload-identity-better-authentication-for-your-gke-applications A Cloud IAM service account is an identity that an application can use to make requests to Google APIs. As an application developer, you could generate individual IAM service accounts for each application, and then download and store the keys as a Kubernetes secret that you manually rotate. Not only is this process burdensome, but service account keys only expire every 10 years (or until you manually rotate them). In the case of a breach or compromise, an unaccounted-for key could mean prolonged access for an attacker. This potential blind spot, plus the management overhead of key inventory and rotation, makes using service account keys as secrets a less than ideal method for authenticating GKE workloads.
upvoted 8 times
alex8081
2 years, 10 months ago
Exact... and it's a recent alternative to secrets ... why would google want you to ignore it? :)
upvoted 2 times
...
...
htakami
Highly Voted 3 years, 2 months ago
I assume that nobody read through the official docs and GCP Best practices for K8s and Cloud SQL. https://cloud.google.com/sql/docs/mysql/connect-kubernetes-engine#secrets "A database credentials Secret includes the name of the database user you are connecting as, and the user's database password." The best answer here is B, having K8s Secrets is the go-to method to configure and store sensitive information within a cluster such as Spanner credentials
upvoted 5 times
...
dneves
Most Recent 5 months, 3 weeks ago
Selected Answer: A
Answer A. Workload Identity: Native GKE-IAM integration No credential management needed Automatic rotation Google-recommended approach Minimal code changes
upvoted 1 times
...
forallthings
6 months, 2 weeks ago
Selected Answer: B
The question is to retrieve Spanner credentials, i.e username and password. Workload Identity is to allow GKE app to connect to Spanner service, not to access the DB.
upvoted 1 times
forallthings
6 months, 2 weeks ago
Correcting myself. A is the right answer. Cloud Spanner does not use traditional approach with username and password
upvoted 1 times
...
...
thewalker
11 months ago
Selected Answer: A
The best answer here is A. Configure the appropriate service accounts, and use Workload Identity to run the pods. Here's why: Workload Identity: Workload Identity is a Google Cloud feature that allows Kubernetes service accounts to act as Google Cloud IAM service accounts. This means your pods can authenticate to Spanner without needing to store credentials directly within the pod.
upvoted 1 times
thewalker
11 months ago
Let's break down why the other options are less ideal: B. Store credentials as Kubernetes Secrets: While this approach works, it's less secure than Workload Identity. Storing credentials in Secrets exposes them to potential security risks within the cluster. C. VPC-native cluster and routing rules: This approach focuses on network connectivity but doesn't address the core issue of secure credential management. D. Cloud Key Management Service (KMS): KMS is excellent for managing encryption keys, but it's not the primary solution for retrieving Spanner credentials. KMS is more suited for encrypting data at rest.
upvoted 1 times
thewalker
11 months ago
Why Workload Identity is the Best Practice: Security: Workload Identity eliminates the need to store sensitive credentials within your pods, making your application more secure. Simplified Management: You can manage access control and permissions through Google Cloud IAM, which is easier than managing credentials within your Kubernetes cluster. Integration with Google Cloud: Workload Identity seamlessly integrates with Google Cloud services, making it a natural choice for applications running on GKE.
upvoted 1 times
...
...
...
braska
1 year, 7 months ago
Selected Answer: A
Option A is the recommended approach for securely configuring your microservice-based application to retrieve Spanner credentials on Google Kubernetes Engine (GKE)
upvoted 1 times
...
__rajan__
1 year, 9 months ago
Selected Answer: A
This approach involves configuring service accounts with the necessary permissions to access the Spanner database. By using Workload Identity, you can associate these service accounts with your Kubernetes Engine pods, allowing them to authenticate and retrieve Spanner credentials automatically.
upvoted 2 times
...
closer89
2 years, 1 month ago
Selected Answer: B
i go for B question is about how to RETRIEVE db creds https://cloud.google.com/sql/docs/mysql/connect-kubernetes-engine#secrets A is about how to connect to spanner
upvoted 1 times
...
[Removed]
2 years, 4 months ago
Selected Answer: A
Google recommends using service accounts and work load identity whenever possible
upvoted 2 times
felipeschossler
2 years, 1 month ago
Exactly!
upvoted 1 times
...
...
omermahgoub
2 years, 5 months ago
A. Configure the appropriate service accounts, and use Workload Identity to run the pods. Workload Identity is a way to associate Kubernetes service accounts with Google Cloud IAM service accounts, allowing your pods to authenticate to Google Cloud services using their IAM identity. This means that you don't have to store application credentials in your code or in Kubernetes Secrets, and you can manage the permissions of your application in Google Cloud IAM. You would need to create service account in cloud IAM and a Kubernetes service account and then map them to use Workload Identity. You can also use gcloud command line to map the Kubernetes service account to the desired IAM service account. Then in your application, you can use the Kubernetes service account to authenticate to Spanner, which will authenticate as the mapped IAM service account. This way you don't have to hardcode credentials in your code, and you can easily manage the permissions of your application using Google Cloud IAM.
upvoted 1 times
...
zellck
2 years, 5 months ago
Selected Answer: A
A is the answer. https://cloud.google.com/kubernetes-engine/docs/concepts/workload-identity#what_is Applications running on GKE might need access to Google Cloud APIs such as Compute Engine API, BigQuery Storage API, or Machine Learning APIs. Workload Identity allows a Kubernetes service account in your GKE cluster to act as an IAM service account. Pods that use the configured Kubernetes service account automatically authenticate as the IAM service account when accessing Google Cloud APIs. Using Workload Identity allows you to assign distinct, fine-grained identities and authorization for each application in your cluster.
upvoted 1 times
...
TNT87
2 years, 6 months ago
Selected Answer: A
Answer is A Store the application credentials as Kubernetes Secrets, and expose them as environment variables
upvoted 2 times
TNT87
2 years, 6 months ago
Sorry i dwant to paste the link to A, not answer B. B is wrong. https://kubernetes.io/docs/concepts/configuration/secret/#alternatives-to-secrets Answer A
upvoted 1 times
TNT87
2 years, 6 months ago
It cant be B because Because Secrets can be created independently of the Pods that use them, there is less risk of the Secret (and its data) being exposed during the workflow of creating, viewing, and editing Pods. Kubernetes, and applications that run in your cluster, can also take additional precautions with Secrets, such as avoiding writing secret data to nonvolatile storage. Secrets are similar to ConfigMaps but are specifically intended to hold confidential data. Caution: Kubernetes Secrets are, by default, stored unencrypted in the API server's underlying data store (etcd). Anyone with API access can retrieve or modify a Secret, and so can anyone with access to etcd. Additionally, anyone who is authorized to create a Pod in a namespace can use that access to read any Secret in that namespace; this includes indirect access such as the ability to create a Deployment.
upvoted 1 times
...
...
...
tomato123
2 years, 10 months ago
Selected Answer: A
I think A is correct
upvoted 4 times
...
nehaxlpb
2 years, 11 months ago
Selected Answer: A
A and B ,both are correct. Curently in my project we are using A for allowing pods to query Bigquery. So A and B both seems to be correct.
upvoted 1 times
akshaychavan7
2 years, 10 months ago
A service account will only allow you to establish your workload identity(basically authenticate the identity of your cluster pods). But, in order to establish a database connection, you would need to connect it using the DB credentials( like host, user id, password, and database name to connect to). To securely store such credentials, Google recommends using a Secret Manager. So the answer would be B!
upvoted 1 times
...
...
[Removed]
3 years ago
Selected Answer: B
B. The question is not about how to connect/access Cloud Spanner, but is how to "retrieve Spanner *credentials*".
upvoted 3 times
...
brewpike
3 years ago
A and B -> It should be select 2 best options question.
upvoted 1 times
...
americoleonardo
3 years ago
Selected Answer: B
I think B is more suitable in this situation
upvoted 3 times
...
Load full discussion...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel