Which external identity provider can be used with Workload Identity Federation?

Any OIDC-compatible identity provider

An application running on Compute Engine needs to access a Cloud Storage bucket. The security team wants to ensure that the credentials used by the application are automatically rotated and have a short lifetime. What should you do?

Use the default service account of the project.

Attach a service account to the VM and use the metadata server to obtain tokens.

Create a service account and grant the VM's service account the Service Account Token Creator role.

Create a service account key and store it in a secure location on the VM.

An organization has a policy that service account keys must be rotated every 90 days. A service account has a key that is 120 days old. What should you do?

Change the service account's permissions to reduce risk.

Leave the key as is because it is still working.

Delete the old key and create a new key.

Disable the old key and re-enable it after 90 days.

What is the primary purpose of Workload Identity Federation?

To allow external workloads to authenticate to Google Cloud without using service account keys.

To provide a single sign-on experience for Google Workspace users.

To automatically create service accounts for external workloads.

To sync on-premises Active Directory users to Google Cloud.

A user needs to temporarily act as a service account to run a command. What is the recommended way to do this?

Use the gcloud auth print-access-token command with the service account.

Use the gcloud --impersonate-service-account flag with the service account email.

Use the gcloud auth activate-service-account command with the service account key.

Use the gcloud iam service-accounts create command.

Google CloudProfessional Cloud Security Engineer

Domain 1Objective 2

1.2 Managing Service Accounts PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 1)

Part of the Configuring access domain, which accounts for 25% of the PROFESSIONAL-CLOUD-SECURITY-ENGINEER exam.

22questions here

5free pages

7concepts

25%of the exam

Questions 1–5

1foundation · easy
Which external identity provider can be used with Workload Identity Federation?
Select an answer first
2application · medium
An application running on Compute Engine needs to access a Cloud Storage bucket. The security team wants to ensure that the credentials used by the application are automatically rotated and have a short lifetime. What should you do?
Select an answer first
3application · medium
An organization has a policy that service account keys must be rotated every 90 days. A service account has a key that is 120 days old. What should you do?
Select an answer first
4foundation · easy
What is the primary purpose of Workload Identity Federation?
Select an answer first
5foundation · easy
A user needs to temporarily act as a service account to run a command. What is the recommended way to do this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.