mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: A developer accidentally exposed their gcloud…
A developer accidentally exposed their gcloud application default credentials (ADC) file. They need to immediately revoke these credentials. Which command revokes the active application default credentials?
⚠ Common exam trap
Google Cloud often tests the distinction between user credentials (`gcloud auth`) and application credentials (`gcloud auth application-default`), and the trap here is that candidates mistakenly think deleting the file or using a general revoke command is sufficient, overlooking the need to explicitly revoke the OAuth refresh token server-side.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
gcloud auth application-default revoke
`gcloud auth application-default revoke` is the specific command designed to revoke the Application Default Credentials (ADC) that were set via `gcloud auth application-default login`. This command invalidates the OAuth 2.0 refresh token stored in the ADC file, ensuring the credentials can no longer be used for authentication to Google Cloud APIs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
gcloud auth revoke [ACCOUNT_EMAIL]
Why it's wrong here
The `gcloud auth revoke` command revokes the OAuth token that the gcloud CLI itself uses for your user account, stored in the gcloud credentials database. Application default credentials obtained via `gcloud auth application-default login` live in a separate file (`application_default_credentials.json`) and represent a distinct token; revoking one does not invalidate the other.
- ✓
gcloud auth application-default revoke
Why this is correct
`gcloud auth application-default revoke` is the dedicated command that both deletes the local ADC file and sends a revocation request to Google so the underlying OAuth token is invalidated server-side. This ensures that any client library already holding the token can no longer use it, which is the only fully secure way to revoke ADC.
- ✗
Delete the ~/.config/gcloud/application_default_credentials.json file manually
Why it's wrong here
Simply deleting `~/.config/gcloud/application_default_credentials.json` removes the local copy of the credentials, but the OAuth token itself remains valid on Google's authorization server until it expires or is explicitly revoked. Any process that has already loaded the token from the file can continue using it, making manual deletion ineffective for immediate revocation.
- ✗
gcloud config unset auth/application_default_credentials
Why it's wrong here
Running `gcloud config unset` targets the gcloud command's configuration properties (e.g., region, project), but application default credentials (ADC) are not stored as a config property. There is no `auth/application_default_credentials` key in gcloud's config hierarchy, so this command cannot locate or revoke the ADC token; it would either error out or simply do nothing meaningful.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Application Default Credentials
Application Default Credentials (ADC) is a built-in Google Cloud mechanism that automatically finds and provides the right credentials for your application to authenticate to Google Cloud services without hardcoding secrets.
Key term
Google Cloud
Google Cloud is a suite of cloud computing services offered by Google that provides infrastructure, platform, and software solutions over the internet.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.