CPENT Cloud And Hybrid Infrastructure Security Practice Question
During an assessment of a Google Cloud Platform (GCP) environment, a penetration tester finds a Compute Engine instance with default service account credentials and scopes set to https://www.googleapis.com/auth/cloud-platform. What security implication does this broad scope present?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The service account possesses permissions across all GCP services unless explicitly restricted by IAM project-level bindings.
The default compute service account with full cloud-platform scope grants broad access to GCP APIs unless further restricted by IAM roles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Google Cloud automatically rotates the service account private key every 60 seconds.
Why it's wrong here
Google manages service account keys without automatic 60-second rotation.
- ✓
The service account possesses permissions across all GCP services unless explicitly restricted by IAM project-level bindings.
Why this is correct
Broad scopes combined with broad IAM roles expose the entire project.
- ✗
The instance is automatically accessible via SSH from any external IP address without firewall rules.
Why it's wrong here
Firewall rules still govern network access regardless of service account scopes.
- ✗
The instance metadata server disables access tokens to prevent Server-Side Request Forgery.
Why it's wrong here
Metadata servers are active by default on GCP instances.
About these practice questions
Courseiva writes every CPENT question from scratch — 274 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CPENT practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CPENT exam.