mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: A team's CI/CD pipeline authenticates to GCP…
A team's CI/CD pipeline authenticates to GCP using Application Default Credentials (ADC). The pipeline runs on a GCE VM with a service account attached. Which credential source does the ADC use when running on a GCE VM?
⚠ Common exam trap
Google Cloud often tests the misconception that ADC always requires an explicit credential file or that it uses the gcloud user login, when in fact on GCE VMs it transparently uses the attached service account via the metadata server.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VM's attached service account credentials via the instance metadata server
On a GCE VM, Application Default Credentials (ADC) automatically uses the credentials from the VM's attached service account by querying the instance metadata server at the link-local address 169.254.169.254. This is the default behavior when no environment variable or other credential source is explicitly configured, making option B correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The GOOGLE_APPLICATION_CREDENTIALS environment variable pointing to a JSON key file
Why it's wrong here
While the GOOGLE_APPLICATION_CREDENTIALS environment variable is indeed the first place ADC checks for credentials, in this scenario it is not set. If it were set to a JSON service-account key file, ADC would use that file's private key to mint access tokens — but because it is absent, ADC falls through to the GCE metadata server. Consequently, this option cannot be what ADC actually uses on the VM; it would only apply if the environment variable had been explicitly configured.
- ✓
The VM's attached service account credentials via the instance metadata server
Why this is correct
On a Compute Engine VM, Application Default Credentials automatically uses the service account that was attached to the instance at creation time by querying the instance metadata server at metadata.google.internal/computeMetadata/v1/instance/service-accounts/. The metadata server returns a short-lived OAuth 2.0 access token with scopes defined on the instance, eliminating the need for any downloaded key file on disk. The client libraries cache and refresh these tokens automatically, making this the default and most secure credential source in a GCE environment.
- ✗
The developer's personal Google account used during `gcloud auth login`
Why it's wrong here
Credentials obtained via `gcloud auth login` are user credentials stored in the gcloud CLI's config directory (e.g., ~/.config/gcloud/application_default_credentials.json) and are intended for local development, not for production workloads on GCE. When code runs on a VM, ADC ignores the user's personal account and instead queries the instance metadata server for the attached service account's token. Relying on a developer's OAuth login would also couple production behavior to a human identity and its expiry, which is why the instance identity is the correct mechanism.
- ✗
A randomly selected service account from the project's service accounts list
Why it's wrong here
ADC does not randomly select a service account from the project's list of service accounts; it specifically uses the service account bound to the instance's identity. The metadata server exposes a default service account at the 'default' alias, which corresponds to the instance's attached service account, and that is the only one ADC consults. A project may contain many service accounts, but none of them are used unless they have been explicitly attached to the VM or referenced via an environment variable.
Go deeper
Related to this question
Learn chapter
GCP IAM and Service Accounts
Key term
Metadata server
A metadata server is a network-accessible service that provides configuration data, credentials, and instance-specific information to virtual machines running in a cloud environment like Google Cloud Platform.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.