mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: A team enables OS Login on their GKE node pool
A team enables OS Login on their GKE node pool. What does OS Login provide for SSH access to GKE nodes compared to the default metadata-based SSH key approach?
⚠ Common exam trap
Test-takers frequently confuse OS Login with SSH key management in metadata, thinking it still requires manual key distribution, when in fact it delegates authentication entirely to IAM, making access fully revocable and auditable without metadata updates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OS Login links SSH access to IAM roles — access is centrally managed and revocable via IAM without updating VM metadata
OS Login links SSH access to IAM roles, so access is centrally managed and revocable via IAM without updating VM metadata. This means you can grant or revoke SSH access to GKE nodes by assigning or removing IAM roles (e.g., roles/compute.osLogin) on user or service accounts, eliminating the need to manage SSH keys in instance metadata. This provides a more secure and auditable access control mechanism compared to the default metadata-based SSH key approach.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
OS Login stores SSH keys in a Cloud KMS-managed keystore for enhanced encryption
Why it's wrong here
OS Login does not use Cloud KMS to store SSH keys. Instead, the user's public key is stored in their OS Login profile, and the private key remains on the user's machine. Cloud KMS manages encryption keys for cryptographic objects, not SSH authentication data. OS Login eliminates metadata-stored SSH keys by linking access to IAM roles, so there is no separate keystore involved.
- ✓
OS Login links SSH access to IAM roles — access is centrally managed and revocable via IAM without updating VM metadata
Why this is correct
OS Login links SSH access to IAM roles like `roles/compute.osLogin` or `roles/compute.osAdminLogin`. When a user is granted one of these roles, they can SSH into instances using their own identity, and revoking that role immediately removes access across all VMs without requiring metadata edits or key cleanup. This centralizes access management, simplifies revocation, and improves auditability compared to storing keys per instance.
- ✗
OS Login automatically generates and rotates SSH key pairs every 24 hours
Why it's wrong here
OS Login does not generate or rotate SSH key pairs on any schedule. Users generate their own keys and register the public key with their Google account via `gcloud compute os-login ssh-keys add`. While OS Login supports ephemeral SSH certificates, they are short-lived by design but not automatically rotated every 24 hours. Rotation is a manual or policy-driven process, not an OS Login feature.
- ✗
OS Login restricts SSH access to connections from specific IP ranges defined in Cloud Armor
Why it's wrong here
OS Login is an identity-base mechanism, not a network filter. It does not inspect or restrict source IP addresses; network-level access control is handled by VPC firewall rules or Identity-Aware Proxy (IAP) TCP tunneling. Cloud Armor protects HTTP(S) load-balanced traffic, not direct SSH to compute instances. This option incorrectly conflates identity management with network security.
Go deeper
Related to this question
Learn chapter
Google Compute Engine
Key term
Node pool
A node pool is a group of virtual machines (nodes) within a container orchestration cluster that share the same configuration, such as machine size, operating system, and scaling settings, allowing you to manage them as a single unit.
Key term
GKE
GKE is Google's managed Kubernetes service that automates deploying, scaling, and managing containerized applications in the cloud.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.