Crucial Exams

GCP Professional Cloud Security Engineer Practice Question

A penetration test shows that a server-side request forgery (SSRF) flaw in an internal web service running on several Compute Engine VMs lets an attacker fetch the VM's access token from the metadata endpoint at http://169.254.169.254/computeMetadata/v1beta1/ The application must keep using its current service account to invoke Google APIs, and you need a rapid mitigation that requires no changes to application code. What should you do?

  • Migrate the backend service to Cloud Run behind a Cloud Load Balancer to eliminate direct VM access.

  • Set the metadata key enable-legacy-endpoints to FALSE for the project so that only requests containing the required Metadata-Flavor: Google header can reach the v1 metadata server.

  • Enable OS Login and Shielded VM secure boot on the instances to harden the guest operating system.

  • Detach the service account from the VMs and re-implement Google API calls with Workload Identity Federation.

GCP Professional Cloud Security Engineer
Ensuring data protection
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot