mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: An application uses the S3-compatible API to…
An application uses the S3-compatible API to interact with Cloud Storage. The team needs credentials compatible with HMAC-based S3 authentication. Which credential type does Cloud Storage support for this?
⚠ Common exam trap
Google Cloud often tests the distinction between authentication methods (HMAC vs. OAuth 2.0) and encryption keys (KMS vs. HMAC), leading candidates to confuse a JSON key file or an API key with HMAC credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HMAC keys created for a service account in Cloud Storage settings
Cloud Storage supports HMAC keys for service accounts to provide S3-compatible authentication. These keys consist of an access key and a secret key, which are used to sign requests using the HMAC-SHA256 algorithm, matching the AWS S3 signature process. This allows applications using the S3 API to authenticate directly against Cloud Storage without needing a JSON key file or OAuth 2.0 tokens.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Service account JSON key file — it's compatible with the S3 HMAC authentication format
Why it's wrong here
A service account JSON key file uses an RSA private key to sign JWT assertions for OAuth 2.0 token exchange, which is how it authenticates GCP API calls. Amazon S3-compatible tooling, however, expects an HMAC-SHA1 signature derived from a shared access key ID and secret, not an RSA-signed bearer token. This incompatibility means JSON key files cannot be used as credentials for S3 interoperability with Cloud Storage, even though they may appear to be the default service account credential.
- ✓
HMAC keys created for a service account in Cloud Storage settings
Why this is correct
HMAC keys created for a service account in Cloud Storage settings are the correct mechanism for enabling S3-compatible API access to Cloud Storage. Each key gives an access key ID and a secret access key, which S3 SDKs and tools such as AWS CLI use to sign requests with HMAC-SHA1 or HMAC-SHA256. These keys are separate from OAuth 2.0 credentials, are scoped to the associated service account's permissions, and are explicitly designed for Google Cloud's XML API and S3 interoperability.
- ✗
Cloud KMS symmetric keys configured for Cloud Storage access
Why it's wrong here
Cloud KMS symmetric keys are intended for encrypting data at rest, not for authenticating API requests. While a bucket can be configured to use a Cloud KMS key for server-side encryption, that key only controls how object data is encrypted; it does not act as a credential for the requesting client. Even if such a key is associated with Cloud Storage, S3 clients cannot derive the access key ID and secret needed for HMAC authentication from a KMS key, so it cannot serve as the required authentication method.
- ✗
An API key generated in the GCP Console for Cloud Storage
Why it's wrong here
An API key generated in the GCP Console identifies the calling project for quota and billing purposes, but it does not authenticate a specific principal or provide a secret for HMAC signing. S3-compatible APIs require request signing with an access key and secret; an API key has no such secret component and cannot be used to construct the required HMAC signature. Consequently, API keys fail to satisfy the authentication handshake performed by S3 clients and are not a valid substitute for HMAC keys.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.