PCD Question 69

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  The most secure approach is B. Use the instance's service account Application Default Credentials to authenticate to the required resources. Here's why: Application Default Credentials (ADC): ADC is a Google Cloud feature that allows applications running on Google Cloud to automatically authenticate using the service account associated with the instance. This eliminates the need to store credentials directly on the instance, reducing security risks. No Manual Credential Management: ADC handles authentication automatically, eliminating the need to manually manage credentials, which can be error-prone and introduce security vulnerabilities. Key Rotation: Google Cloud automatically rotates service account keys, further enhancing security.

• 1

  Let's look at why the other options are less secure: A. Use HTTP signed URLs to securely provide access to the required resources: HTTP signed URLs are useful for providing temporary access to specific resources, but they don't address the core issue of securely storing and managing service account credentials. C. Generate a P12 file from the GCP Console after the instance is deployed and copy the credentials to the host instance before starting the application: This approach requires storing credentials on the instance, which is a security risk. It also introduces manual steps that can be error-prone. D. Commit the credential JSON file into your application's source repository and have your CI/CD process package it with the software that is deployed to the instance: This is a major security risk. Storing credentials in source code exposes them to anyone with access to the repository.

• Chose B1

  Option B is Correct: This approach ensures that the credentials are securely managed and automatically provided to the instances when needed.