hardMultiple SelectObjective-mapped
Google ACE Practice Question: A company requires that all service account keys…
A company requires that all service account keys be automatically rotated every 90 days. Which two steps should the administrator take to enforce this? (Choose two.)
⚠ Common exam trap
Google Cloud often tests the misconception that there is a built-in 'auto-rotate' toggle in the console, but in reality, you must use API-level expiration or custom automation like Cloud Functions to enforce rotation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Service Account API to create keys with a custom expiration time.
The Service Account API allows creating keys with a custom expiration time, which enforces automatic rotation by ensuring keys are invalid after 90 days. Option E is correct because a Cloud Function can monitor key age and delete keys older than 90 days, providing a programmatic enforcement mechanism. Both approaches ensure keys are rotated automatically without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable the Service Account Key Rotator in the Google Cloud Console.
Why it's wrong here
There is no built-in Service Account Key Rotator in the Google Cloud Console. While the console provides manual key creation, deletion, and disabling options, it does not offer a native automated rotation feature. To achieve rotation, you must either use the Service Account API's expiration fields or implement a custom automation such as a Cloud Function; a console 'rotator' simply does not exist.
- ✗
Use IAM to set a condition that keys must have an expiration date.
Why it's wrong here
IAM conditions allow you to grant access based on request-time attributes (e.g., resource tags, date/time, or originating IP) but cannot enforce or alter the properties of service account keys themselves. Key expiration is a lifecycle setting on the key resource, not an authorization constraint. Therefore, you cannot use an IAM condition to require that keys have an expiration date or to automatically rotate them.
- ✓
Use the Service Account API to create keys with a custom expiration time.
Why this is correct
The Service Account API's keys.create method supports user-managed keys with a validBeforeTime (expiration) field, allowing you to set an exact expiration timestamp at creation time. When a key reaches that time, it becomes invalid, effectively forcing a controlled lifespan and enforcing rotation via a key refresh process. This is a native Google Cloud mechanism for key rotation that does not require external automation, making it a correct approach.
- ✗
Use an Organization Policy to disable service account key creation.
Why it's wrong here
An Organization Policy can restrict or disable user-managed service account key creation across the hierarchy, but that is a safety control, not a rotation strategy. Disabling key creation prevents all new user-managed keys, which would block legitimate rotation workflows that need to create replacement keys. Additionally, this policy does not handle deletion or expiry of existing keys, so it cannot enforce a 90-day rotation cadence.
- ✓
Use a Cloud Function to monitor key age and delete keys older than 90 days.
Why this is correct
A Cloud Function can be scheduled via Cloud Scheduler to list all service account keys, inspect their validAfterTime (creation time), and programmatically delete any key older than 90 days using the Service Account API's keys.delete method. This active, custom automation enforces rotation by removing aged credentials, and is a correct pattern when you need policy-controlled, code-based management rather than relying solely on native expiration. The detection and deletion loop directly binds key age to a lifecycle enforcement action.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
Service account
A service account is a special type of account used by an application or a virtual machine, rather than a human user, to authenticate and interact with cloud services and APIs securely.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.