PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #347
Your organization is migrating its primary web application from on-premises to Google Kubernetes Engine (GKE). You must advise the development team on how to grant their applications access to…
The correct answer is B. Enable Workload Identity for GKE. Assign a Kubernetes service account to the application and. Enabling Workload Identity and mapping Kubernetes service accounts to IAM service accounts allows fine-grained, secure, and manageable access to Google Cloud services from within GKE. This approach avoids using node-level service accounts or static keys, following Google Cloud…
Question
Options
- AConfigure the GKE nodes to use the default Compute Engine service account.
- BEnable Workload Identity for GKE. Assign a Kubernetes service account to the application and
- CCreate a user-managed service account with only the roles required for the specific workload.
- DCreate an application-specific IAM service account and generate a user-managed service account
How the community answered
(66 responses)- A6% (4)
- B74% (49)
- C3% (2)
- D17% (11)
Explanation
Enabling Workload Identity and mapping Kubernetes service accounts to IAM service accounts allows fine-grained, secure, and manageable access to Google Cloud services from within GKE. This approach avoids using node-level service accounts or static keys, following Google Cloud security best practices by minimizing risk and improving identity isolation per workload.
Topics
Community Discussion
No community discussion yet for this question.