You are running applications outside Google Cloud that need access to Google Cloud resources. You are using workload identity federation to grant external identities Identity and Access Management…

Question

Options

• AEnable data access logs for IAM APIs.
• BLimit the number of external identities that can impersonate a service account.
• CUse a dedicated project to manage workload identity pools and providers.
• DUse immutable attributes in attribute mappings.
• ELimit the resources that a service account can access.

• A
  19% (9)
• B
  4% (2)
• C
  64% (30)
• E
  13% (6)

Explanation

Using a dedicated project (C) isolates your workload identity pools and providers from application workloads, reducing the blast radius of misconfiguration and making access easier to audit - a Google-recommended best practice for identity infrastructure. Using immutable attributes in attribute mappings (D) directly prevents spoofing: immutable attributes (e.g., the subject identifier issued by your IdP) cannot be altered after issuance, so a malicious actor cannot manipulate attribute values to impersonate another identity.

Why the distractors are wrong:

• A (data access logs) is a detective control - it records what happened after the fact but does nothing to prevent spoofing.
• B (limit impersonators) controls who can impersonate a service account but doesn't address whether the identity claim itself can be forged.
• E (limit service account resources) applies least-privilege to reduce damage from a successful breach, but it doesn't prevent the spoofing in the first place.

Memory tip: Think "Isolate + Immutate" - a dedicated project isolates your identity infrastructure, and immutable attributes make identity claims tamper-proof. Both target the security architecture of the federation setup itself, not just downstream effects.

No community discussion yet for this question.