What is a recommended practice for managing service account keys?

Use long-lived keys and store them in the application source code for easy access.

Rotate keys regularly and audit key usage.

Create multiple keys for the same service account to ensure availability.

Share keys among team members to simplify access management.

A developer created a service account key and accidentally committed it to a public GitHub repository. The key was exposed for 24 hours before the commit was removed. What is the most immediate action you should take?

Delete the compromised key and create a new key for the service account.

Do nothing because the commit was removed from GitHub.

Rotate the key by disabling it and then re-enabling it after 24 hours.

Change the service account's IAM roles to remove all permissions.

A company has a project where the default Compute Engine service account has been used for years. An audit shows that many VMs are using this service account, and it has the Editor role. The security team wants to migrate to least-privilege service accounts without disrupting running workloads. What is the best approach?

Create dedicated service accounts with least-privilege roles, update the VMs to use them, and then disable the default service account.

Disable the default service account immediately and recreate it with the Viewer role.

Delete the default service account and recreate it with the same name.

Change the default service account's role to Viewer and leave the VMs as is.

Which Google Cloud feature can be used to generate short-lived credentials for a service account?

Service Account Credentials API

A company has an on-premises application that needs to access Google Cloud Storage. The security team wants to avoid storing long-lived service account keys on the on-premises server. What is the recommended solution?

Use a VPN to connect to Google Cloud and then use the default service account.

Store a service account key in a local file with restricted permissions.

Create a service account and share the key via a secure file transfer.

Use Workload Identity Federation with an OIDC identity provider.

Google CloudProfessional Cloud Security Engineer

Domain 1Objective 2

1.2 Managing Service Accounts PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 2)

Part of the Configuring access domain, which accounts for 25% of the PROFESSIONAL-CLOUD-SECURITY-ENGINEER exam.

22questions here

5free pages

7concepts

25%of the exam

Questions 6–10

6foundation · easy
What is a recommended practice for managing service account keys?
Select an answer first
7application · medium
A developer created a service account key and accidentally committed it to a public GitHub repository. The key was exposed for 24 hours before the commit was removed. What is the most immediate action you should take?
Select an answer first
8expert · hard
A company has a project where the default Compute Engine service account has been used for years. An audit shows that many VMs are using this service account, and it has the Editor role. The security team wants to migrate to least-privilege service accounts without disrupting running workloads. What is the best approach?
Select an answer first
9foundation · easy
Which Google Cloud feature can be used to generate short-lived credentials for a service account?
Select an answer first
10application · medium
A company has an on-premises application that needs to access Google Cloud Storage. The security team wants to avoid storing long-lived service account keys on the on-premises server. What is the recommended solution?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.