4.2 Managing Service Accounts ASSOCIATE-CLOUD-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   You need to generate a short-lived OAuth2 access token for a service account to authenticate to a Google Cloud API. What is the default maximum lifetime of such an access token?

   • A12 hours
   • B7 days
   • C1 hour
   • D24 hours
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of service account impersonation?

   • ATo allow a principal to temporarily act as a service account to perform actions with its permissions.
   • BTo permanently transfer ownership of a service account to another user.
   • CTo create a new service account that is a copy of an existing one.
   • DTo allow a service account to access resources in another project without any IAM roles.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A GKE cluster runs multiple microservices. One microservice needs to publish messages to Pub/Sub, and another needs to read from a specific Cloud Storage bucket. The team wants to grant each microservice only the permissions it needs. What is the best approach?

   • ACreate separate Google service accounts for each microservice, grant the appropriate roles, and bind each to a distinct Kubernetes service account using Workload Identity.
   • BCreate service account keys for each microservice and mount them as secrets.
   • CUse the same Google service account for all microservices and grant it both Pub/Sub Publisher and Storage Object Viewer.
   • DUse the node's service account for all microservices.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company runs workloads on AWS and wants them to access Google Cloud Storage. They want to avoid creating and rotating service account keys. What should they configure?

   • AUse the default Compute Engine service account from a GCP project.
   • BCreate a service account and share its email and password with the AWS workloads.
   • CCreate a service account key and store it in AWS Secrets Manager for the workloads to use.
   • DSet up Workload Identity Federation with AWS as the identity provider and map the AWS IAM role to a Google service account.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   You need to grant a service account permission to publish messages to a Pub/Sub topic. Which IAM role should you assign to the service account?

   • Aroles/pubsub.subscriber
   • Broles/pubsub.publisher
   • Croles/pubsub.editor
   • Droles/pubsub.viewer
   Reveal Solution Discussion Select an answer first