4.2 Managing Service Accounts ASSOCIATE-CLOUD-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a Google-managed service account that is automatically created and used by Google Cloud services?

   • AA service account you create with gcloud
   • BA service account used for Workload Identity Federation
   • CA service account key you create in the console
   • DThe default Compute Engine service account
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary use case for a short-lived ID token issued to a service account?

   • ASigning arbitrary blobs for data integrity.
   • BAuthenticating to Google Cloud APIs that accept OAuth2 access tokens.
   • CStoring credentials for long-term use.
   • DAuthenticating to your own application that verifies OpenID Connect tokens.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A CI/CD pipeline needs to authenticate to Google Cloud APIs for a deployment step. The pipeline runs on a third-party CI service and cannot use a service account key stored in the repository. The team wants to use short-lived credentials. What is the recommended approach?

   • AUse Workload Identity Federation to exchange the CI provider's OIDC token for a Google Cloud access token.
   • BGenerate a service account key and store it in the CI system's secret manager.
   • CHave the CI service use the default Compute Engine service account.
   • DCreate a service account and share its email and password with the CI service.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   You want to allow a user to temporarily act as a service account to generate an access token for a one-time task. Which IAM role should you grant the user on the service account?

   • Aroles/iam.serviceAccountAdmin
   • Broles/iam.serviceAccountUser
   • Croles/iam.serviceAccountTokenCreator
   • Droles/iam.serviceAccountViewer
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary benefit of using Workload Identity in GKE compared to using service account keys?

   • AIt automatically grants the pod all IAM roles in the project.
   • BIt allows the pod to access resources outside Google Cloud without any configuration.
   • CIt allows multiple Google Cloud service accounts to be used by a single pod.
   • DIt eliminates the need to manage and rotate long-lived service account keys.
   Reveal Solution Discussion Select an answer first