Your organization's application is being integrated with a partner application that requires read access to customer data to process customer orders. The customer data is stored in one of your Cloud…

Question

Options

• AScan the Cloud Storage bucket with Sensitive Data Protection when new data is added, and
• BDefine a VPC Service Controls perimeter, and restrict the Cloud Storage API. Add an ingress rule
• CEnsure that all data for the application that is accessed through the relevant service accounts is
• DImplement a secret management service. Configure the service to frequently rotate the service

• A
  4% (1)
• B
  4% (1)
• C
  9% (2)
• D
  83% (19)

Explanation

The primary risk of a compromised service account key is that an attacker can use it to exfiltrate data for as long as the key remains valid. Option D directly mitigates this risk: storing keys in a secret management service (like Secret Manager) and rotating them frequently means a stolen key has a very short window of usefulness before it is invalidated. Frequent rotation is the industry-standard control specifically recommended when service account keys cannot be avoided. Option A (DLP scanning) protects data content but does not reduce the risk of a compromised key being used for access. Option B (VPC Service Controls) can limit network access paths but does not address key compromise directly. Option C is incomplete and vague. D is the most targeted and effective countermeasure for key compromise risk.

No community discussion yet for this question.