Google Updated Professional-Cloud-Security-Engineer Exam Questions and Answers by zachariah

Rotating a user-managed Service Account key involves creating a new key, updating your application to use the new key, and then deleting the old key to maintain security. Here’s the step-by-step process:

Create a New Key: Use the Google Cloud Console or gcloud command-line tool to create a new key for the service account. This generates a new key pair and provides you with the private key.

gcloud iam service-accounts keys create new-key-file.json --iam-account=YOUR_SERVICE_ACCOUNT_EMAIL

Update Application: Update your application configuration to use the new key. This might involve replacing the old key file with the new one or updating the environment variables or configurations that point to the key file.

Delete the Old Key: Once you have confirmed that the application is working correctly with the new key, delete the old key from the service account to ensure it cannot be used for unauthorized access.

gcloud iam service-accounts keys delete OLD_KEY_ID --iam-account=YOUR_SERVICE_ACCOUNT_EMAIL

This process ensures that your service account keys are regularly rotated, reducing the risk of key compromise.

References

Managing Service Account Keys

Service Account Key Rotation

Objective: Encrypt data using envelope encryption.

Solution: Follow the envelope encryption process.

Steps:

Step 1: Generate a Data Encryption Key (DEK) locally. The DEK is used to encrypt the actual data.

Step 2: Encrypt the data using the DEK.

Step 3: Use a Key Encryption Key (KEK) to wrap the DEK. The KEK is used to encrypt the DEK.

Step 4: Store the encrypted data and the wrapped DEK. This ensures that the data can be securely decrypted in the future using the KEK to unwrap the DEK.

Envelope encryption enhances security by adding an additional layer of encryption to the data encryption key, which is particularly useful for managing large volumes of encrypted data.

References:

Envelope Encryption Overview

Google Cloud Key Management Service Documentation

Setting up a Shared VPC allows you to create a centrally managed network that spans multiple projects. Here's how you can achieve this while ensuring separation of duties:

Create a Host Project:

Create a project that will act as the host project for your Shared VPC.

Configure Shared VPC:

In the host project, enable the Shared VPC feature.

Create Service Projects:

Create separate service projects for different teams, such as developers and other stakeholders.

Assign Roles:

Security Team: Grant the Compute Network Admin role. This allows the security team to manage network resources, such as firewall rules, subnets, and routes.

Developers: Share the host project’s network with the service projects. Assign roles like Compute Instance Admin to developers in the service projects, enabling them to create and manage VM instances without altering network configurations.

Firewall Management:

The security team will define and manage firewall rules within the host project, ensuring consistent and secure network policies.

Benefits:

Separation of Duties: Security teams handle networking, and developers focus on application deployment and management.

Centralized Control: Network policies are centrally managed, ensuring compliance and security.

Scalability: Easy to add new projects and teams without compromising the overall network security.

References

Google Cloud VPC Documentation

Managing Resources with Shared VPC

Objective: Store and retrieve sensitive configuration data for an application running on Compute Engine.

Solution: Use Secret Manager to securely store and manage access to sensitive configuration data.

Steps:

Step 1: Open the Google Cloud Console.

Step 2: Navigate to the Secret Manager section.

Step 3: Create a new secret and add the sensitive configuration data.

Step 4: Set appropriate IAM policies to control access to the secret.

Step 5: Update the application to retrieve the secret from Secret Manager using the appropriate client libraries or APIs.

Secret Manager provides a secure and centralized way to manage sensitive information, with fine-grained access control and audit logging capabilities.

References:

Secret Manager Documentation

Storing and Accessing Secrets