Google Updated Professional-Cloud-Security-Engineer Exam Questions and Answers by hania

To minimize the usage of service account keys and implement Workload Identity Federation (WIF) with your on-premises identity provider, you can use a workload identity pool integrated with your corporate Active Directory Federation Service (ADFS). This setup allows your on-premises Windows-based applications to authenticate to Google Cloud APIs without using long-lived service account keys.

Set Up a Workload Identity Pool:

In the Google Cloud Console, go to IAM & Admin > Workload Identity Federation.

Create a new workload identity pool.

Configure the pool to trust your corporate ADFS by specifying the federation provider details.

Create a Workload Identity Provider:

Within the created pool, set up a new provider for ADFS.

Configure the provider with the necessary details such as the issuer URL and credentials.

Configure Impersonation Rules:

Set up rules to allow principals in the workload identity pool to impersonate specific Google Cloud service accounts.

This is done by specifying the identity provider and the conditions under which the service accounts can be impersonated.

Update Applications:

Modify your on-premises applications to use the configured ADFS authentication to obtain tokens.

These tokens can then be exchanged for Google Cloud access tokens to interact with Google Cloud APIs securely.

By setting up the workload identity pool and configuring impersonation rules, you achieve secure authentication without needing to distribute and manage service account keys.

Titan Security Keys are a physical form of two-step verification (2SV) that provide the highest level of account security by using cryptographic signatures to verify the user and the URL of the login page.

Cryptographic Security: Titan Security Keys use a hardware-based cryptographic method to authenticate users, which is resistant to phishing attacks. This ensures that the authentication process is secure and not susceptible to being intercepted or spoofed.

URL Verification: Titan Security Keys verify the URL of the login page during the authentication process, providing an additional layer of security against phishing attempts that may try to redirect users to malicious websites.

Ease of Use: These keys are easy to use and integrate with Google's 2SV process, providing a seamless and highly secure authentication method for users.

References

Titan Security Keys

This PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK). The CMEK feature allows you to create, use, and revoke the key encryption key (KEK). Google still controls the data encryption key (DEK). For more information on Google data encryption keys, see Encryption at Rest. https://cloud.google.com/dataproc/docs/concepts/configuring-clusters/customer-managed-encryption

https://codelabs.developers.google.com/codelabs/encrypt-and-decrypt-data-with-cloud-kms#0