Google ACE Practice Question: A team needs to give a third-party vendor…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a GCP service account for the vendor and share the JSON key file with 48-hour expiry

  Why it's wrong here

  A service account JSON key is a long-lived private credential that does not inherently expire; you cannot configure it to expire in 48 hours. Sharing this key with an external vendor is a severe security risk because it grants full API access to any resource the service account can access, and you must manually rotate or delete the key after the intended window—something that is error-prone and potentially leaves the vendor with continued access. Signed URLs avoid sharing credentials entirely and enforce expiry automatically.

• ✓

  Generate a Signed URL for the specific objects with a 48-hour expiration

  Why this is correct

  A signed URL is a time-limited, cryptographically authenticated URL that Cloud Storage generates for a specific object and HTTP method (e.g., GET). It is created by signing the object path, a validity window, and an expiration timestamp with a service account's private key. The vendor receives the URL, requires no GCP account or credentials, and access is automatically invalidated after the 48-hour expiry, making it the correct tool for temporary, controlled sharing.

• ✗

  Use Workload Identity Federation with AWS as the identity provider for the vendor

  Why it's wrong here

  Workload Identity Federation is designed to let external workloads (e.g., an application running on AWS) temporarily impersonate a GCP service account for ongoing API access, not to grant a human vendor one-time access to a few objects. It requires the vendor to configure an AWS identity provider, set up federation trusts, and build an application to call GCP APIs, which is complex and does not naturally expire after 48 hours. For simple, short-lived object sharing, a signed URL is far more appropriate and requires no infrastructure setup.

• ✗

  Make the objects publicly readable and share the direct Cloud Storage URL

  Why it's wrong here

  Setting the objects to publicly readable and sharing the direct storage.googleapis.com URL grants anonymous, unrestricted read access to anyone with the link. Unlike a signed URL, this access does not expire after 48 hours; the objects remain publicly accessible indefinitely until the ACL or IAM policy is manually changed, and it exposes the objects to a much wider audience than just the vendor. This violates the specific requirement for time-limited, vendor-only access.

Go deeper

Related to this question