Crucial Exams

GCP Professional Cloud Security Engineer Practice Question

All Compute Engine VMs in a legacy project run under the [email protected] default service account, which currently holds the Editor role on the project. A new security mandate requires that instances be able to only write objects to the gs://backup-logs bucket, that the default service account be disabled once the change is verified safe, and that nightly backup availability not be disrupted. Which sequence of actions meets these requirements?

  • Create a dedicated service account, grant it the Storage Object Creator role only on gs://backup-logs, stop each VM one at a time, attach the new service account, restart and verify backups, then disable the default compute service account.

  • Create a new service account with the Project Editor role, generate a user-managed key, copy the key to every VM, reconfigure the backup script to use the key file, then disable the default service account.

  • Remove the Editor role from the default compute service account, grant it the Storage Object Creator role on the bucket, leave the VMs running, then delete the default service account after backups succeed.

  • Immediately disable the default compute service account, create a new service account with the Storage Object Admin role, and attach it to each running instance using gcloud without stopping the VMs.

GCP Professional Cloud Security Engineer
Configuring Access
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot