What is the primary security benefit of using short-lived credentials for service accounts?

They are automatically rotated by Google Cloud.

They allow service accounts to be used without any key management.

They eliminate the need for IAM roles.

They reduce the risk of credential compromise by limiting the validity window.

A company runs workloads in AWS that need to access Google Cloud resources. The security team wants to avoid creating and managing Google service account keys. What should you configure?

Workload Identity Federation with AWS as the identity provider.

A service account with the AWS role as a member.

A service account key stored in AWS Secrets Manager.

A VPN between AWS and Google Cloud to allow direct access.

An application running on a Compute Engine VM needs to call a Google Cloud API. Which identity should the application use to authenticate to Google Cloud?

A user account belonging to the application developer

A Google Workspace group account

An API key generated for the project

A service account associated with the VM

An application running on Compute Engine needs to access a Cloud Storage bucket. The security team wants to minimize the lifetime of credentials used by the application. What is the best way to achieve this?

Create a service account key and set an expiration time of 24 hours.

Use the VM's attached service account and let the application obtain tokens from the metadata server.

Generate a service account key and store it in a secure location on the VM.

Use the default service account of the project.

A company has workloads running in AWS and on-premises that need to access Google Cloud resources. The security team wants to eliminate the use of service account keys entirely. What is the most efficient approach?

Configure Workload Identity Federation for both AWS and on-premises workloads.

Create a single service account key and share it between AWS and on-premises workloads.

Use a VPN to connect AWS and on-premises to Google Cloud and use the default service account.

Create separate service accounts for AWS and on-premises with keys stored in each environment.

Google CloudProfessional Cloud Security Engineer

Domain 1Objective 2

1.2 Managing Service Accounts PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Part of the Configuring access domain, which accounts for 25% of the PROFESSIONAL-CLOUD-SECURITY-ENGINEER exam.

22questions here

5free pages

7concepts

25%of the exam

Questions 11–15

11foundation · easy
What is the primary security benefit of using short-lived credentials for service accounts?
Select an answer first
12application · medium
A company runs workloads in AWS that need to access Google Cloud resources. The security team wants to avoid creating and managing Google service account keys. What should you configure?
Select an answer first
13foundation · easy
An application running on a Compute Engine VM needs to call a Google Cloud API. Which identity should the application use to authenticate to Google Cloud?
Select an answer first
14application · medium
An application running on Compute Engine needs to access a Cloud Storage bucket. The security team wants to minimize the lifetime of credentials used by the application. What is the best way to achieve this?
Select an answer first
15expert · hard
A company has workloads running in AWS and on-premises that need to access Google Cloud resources. The security team wants to eliminate the use of service account keys entirely. What is the most efficient approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.