hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A CI/CD pipeline running outside GCP (on GitHub…
A CI/CD pipeline running outside GCP (on GitHub Actions) needs to authenticate to GCP to push images to Artifact Registry, without storing any long-lived service account key files. Which authentication mechanism achieves this?
⚠ Common exam trap
A common mix-up: candidates default to storing a service account key as a secret (Option A) because it's a familiar pattern, failing to recognize that Workload Identity Federation is the modern, keyless alternative specifically designed for external CI/CD providers like GitHub Actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Workload Identity Federation with GitHub Actions as the identity provider
Workload Identity Federation allows a GitHub Actions workflow to exchange a GitHub-issued OIDC token for a GCP access token, enabling authentication to Artifact Registry without storing any long-lived service account keys. This is the recommended approach for non-GCP CI/CD systems because it eliminates the security risk of managing static credentials while still granting fine-grained, short-lived access to GCP resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store a service account JSON key as a GitHub Actions secret and use it in the workflow
Why it's wrong here
Storing a service account JSON key as a GitHub secret does work mechanically, but it creates a long-lived credential that must be rotated manually and can be leaked through logs, forks, or secret exfiltration. If compromised, the key grants all IAM permissions of the service account until it is revoked. Workload Identity Federation avoids this by exchanging a short-lived OIDC token for temporary credentials, so no static key file exists.
- ✓
Workload Identity Federation with GitHub Actions as the identity provider
Why this is correct
Workload Identity Federation lets GitHub Actions present its native OIDC token to a Workload Identity Pool provider; the Security Token Service exchanges it for a short-lived Google-issued access token. The workflow then impersonates a service account via IAM bindings without ever creating or storing a service account key file. Conditional attribute mappings can restrict which repositories, branches, or jobs are allowed to impersonate the identity.
- ✗
OAuth 2.0 user credentials from a developer's Google account
Why it's wrong here
Using a developer's OAuth 2.0 user credentials (e.g., from 'gcloud auth login') requires interactive consent, an installed browser, and refresh-token management that is impractical for headless CI/CD. It also binds the pipeline to a specific person's account, so if that developer leaves or changes roles, the workflow breaks or inherits unintended access. Automated pipelines should use workload identity federation, which grants direct, auditable service account impersonation.
- ✗
API keys created for the Artifact Registry service
Why it's wrong here
API keys are project-level identifiers used for quota and billing on public APIs; they do not represent an authenticated IAM principal. Artifact Registry requires authenticated requests and enforces access control solely through IAM, so API keys are not accepted and would fail with an unauthenticated/unauthorized error. This option ignores that artifact operations must be tied to a service account or user identity for permission evaluation.
Go deeper
Related to this question
Learn chapter
GCP IAM and Service Accounts
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
Artifact Registry
Artifact Registry is a managed service for storing, managing, and securing container images and other software packages in a centralized repository.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.