Exam Professional Cloud Security Engineer topic 1 question 205 discussion

Best practices for protecting against spoofing threats: Use a dedicated project to manage workload identity pools and providers. Use organizational policy constraints to disable the creation of workload identity pool providers in other projects. Use a single provider per workload identity pool to avoid subject collisions. Avoid federating with the same identity provider twice. Protect the OIDC metadata endpoint of your identity provider. Use the URL of the workload identity pool provider as audience. Use immutable attributes in attribute mappings. Use non-reusable attributes in attribute mappings. Don't allow attribute mappings to be modified. Don't rely on attributes that aren't stable or authoritative. Therefore, Option C and D are correct

D,E is correct Immutable attributes in the attribute mappings ensure that the identity information provided by the external identity provider cannot be easily altered. T By applying the principle of least privilege, limiting the resources a service account can access ensures that even if an external identity is compromised or misconfigured, the potential impact is minimized.

CD looks good to me

https://cloud.google.com/iam/docs/best-practices-for-using-workload-identity-federation#protecting_against_spoofing_threats

https://cloud.google.com/iam/docs/best-practices-for-using-workload-identity-federation

C & D - https://cloud.google.com/iam/docs/best-practices-for-using-workload-identity-federation#protecting_against_spoofing_threats