4.2 Managing Service Accounts ASSOCIATE-CLOUD-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   You are creating a Compute Engine instance that needs to access a Cloud SQL database. You want to attach a service account to the instance so that applications on the instance can authenticate to Google Cloud APIs. When can you attach the service account?

   • AOnly at instance creation time
   • BAt any time after instance creation
   • COnly when the instance is stopped
   • DOnly when the instance is running
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A team is migrating a monolithic application to Compute Engine. The application currently uses a service account with broad permissions. The security team wants to reduce the risk of credential misuse. They plan to split the application into two components: one that writes to Cloud Storage and one that reads from BigQuery. They want to run both components on the same instance for now. What is the best way to assign service accounts?

   • AUse the default Compute Engine service account and grant it both roles.
   • BCreate two separate service accounts, one for each component, and attach both to the instance at creation time.
   • CCreate a single service account with both Storage Object Writer and BigQuery Data Viewer roles, and attach it to the instance.
   • DCreate a service account key for each component and store them on the instance.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   You have a GKE cluster with Workload Identity enabled. You want a deployment to access Google Cloud APIs using a specific Google Cloud service account. What is the recommended way to configure this?

   • ASet the `GOOGLE_APPLICATION_CREDENTIALS` environment variable to the path of a service account key file.
   • BUse the node's default service account for all pods.
   • CStore the Google Cloud service account key as a Kubernetes secret and mount it in the pod.
   • DCreate a Kubernetes service account and annotate it with the email of the Google Cloud service account.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A service account is used by a production application. During an incident, a developer needs to temporarily grant the service account additional permissions to debug the issue. The team wants to ensure that the additional permissions are automatically removed after the incident. What is the best approach?

   • AGrant the additional role and manually revoke it after the incident.
   • BCreate a new service account with the additional permissions and switch the application to use it.
   • CUse IAM conditions to grant the additional role only for a specific time window.
   • DUse service account impersonation to grant the developer the additional permissions.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   You have an application running on AWS that needs to access Google Cloud resources. You want to set up Workload Identity Federation so the AWS workload can impersonate a Google Cloud service account. What do you need to configure?

   • AA Kubernetes cluster in Google Cloud to run the workload.
   • BA service account key for the AWS workload to use.
   • CA workload identity pool and a provider for AWS.
   • DA VPN connection between AWS and Google Cloud.
   Reveal Solution Discussion Select an answer first