Google ACE Practice Question: An application running on a Compute Engine VM…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Embed a developer's user account credentials in the application configuration file

  Why it's wrong here

  Embedding a developer's user account credentials into an application config file is both a security risk and an architectural anti-pattern. Human credentials are short-lived OAuth tokens that expire and require re-authentication, and they are tied to an individual's IAM roles, which can change when the user leaves the project. If those credentials leak, an attacker gains the full scope of that developer's access, and the application breaks if the account is revoked. This approach violates the separation between human and machine identities.

• ✓

  Attach a service account with the Storage Object Viewer role to the VM

  Why this is correct

  Attaching a service account to the VM and assigning it the Storage Object Viewer role is the correct approach because it gives the instance a dedicated machine identity with least-privilege access to read objects. The application can automatically obtain OAuth tokens from the instance metadata server without needing to store any credentials locally. This works seamlessly with the Cloud Storage client libraries, which automatically pick up the attached service account's credentials. It also ensures rotation and revocation are managed by Google Cloud, not by application code.

• ✗

  Create an API key and store it as an environment variable on the VM

  Why it's wrong here

  API keys are project-level identifiers that only support simple access, not fine-grained IAM roles like Storage Object Viewer. Storing one in an environment variable on the VM does not turn it into a valid identity for Cloud Storage authorization, and the long-lived secret can be exposed via instance metadata or logs. Since server-to-server calls must authenticate as a concrete principal, an API key cannot satisfy bucket IAM policies, making this option incorrect.

• ✗

  Grant the VM's IP address access to the bucket using a VPC firewall rule

  Why it's wrong here

  VPC firewall rules are network-layer filters that allow or deny traffic to destinations; they never confer data-plane permissions on Cloud Storage. Even if a firewall rule lets the VM reach the Cloud Storage API endpoint, the API request still needs an authenticated IAM identity with the appropriate role on the bucket. Without such an identity, the request is rejected for lack of permission, not because of network blocks. Therefore, firewall rules cannot grant bucket read access.

Go deeper

Related to this question