mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: A GCP organization has recently experienced a…
A GCP organization has recently experienced a credential theft incident involving a service account key. The CISO requires that all service account keys in the organization be inventoried and those older than 90 days be rotated. Which tool identifies old service account keys across all projects?
⚠ Common exam trap
Google Cloud often tests the misconception that Security Command Center handles IAM key lifecycle audits, when in fact Cloud Asset Inventory is the correct service for querying metadata like key creation dates across all projects.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Asset Inventory querying all IAM ServiceAccountKey assets across the organization
Cloud Asset Inventory (CAI) is the correct tool because it can query all IAM ServiceAccountKey assets across the entire organization, including all projects, using a single API call or gcloud command. This allows you to filter by the `validAfterTime` field to identify keys older than 90 days, meeting the CISO's requirement for a comprehensive, automated inventory without manual per-project inspection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Security Command Center — it audits service account key age automatically
Why it's wrong here
Security Command Center does have detectors for certain IAM misconfigurations, but it does not provide a native, automatic finding that reports the age of every service account key across all projects. While SCC can integrate with Cloud Asset Inventory and custom modules, the dedicated, straightforward mechanism for finding old keys is CAI's asset search, not SCC's built-in findings. Relying on SCC to 'automatically audit key age' would require additional configuration or custom detections, so it is not the most direct solution.
- ✓
Cloud Asset Inventory querying all IAM ServiceAccountKey assets across the organization
Why this is correct
Cloud Asset Inventory is the correct tool because it supports organization-scoped queries for the `iam.googleapis.com/ServiceAccountKey` asset type, returning every service account key with its creation timestamp. For example, `gcloud asset search-all-resources --asset-types=iam.googleapis.com/ServiceAccountKey --scope=organizations/ORG_ID` lists all keys, and you can filter by age using `--query` or post-process with `jq` to identify keys older than your rotation policy. This approach provides a complete, auditable, and automated way to detect stale keys across all projects.
- ✗
Cloud Monitoring metric for service account key creation date
Why it's wrong here
Cloud Monitoring collects metrics—numeric time-series measurements such as CPU utilization, request latency, and custom counters—but it does not expose service account key creation timestamps as a metric. To obtain key creation dates you must call the IAM `getServiceAccountKey` API or query Cloud Asset Inventory, both of which return the `createTime` and `validAfterTime` fields directly. There is no metric descriptor for 'service account key creation date' in Cloud Monitoring.
- ✗
Manually check each service account in each project's IAM & Admin > Service Accounts page
Why it's wrong here
Navigating to each project's IAM & Admin > Service Accounts page and manually inspecting keys cannot scale across a large organization: there is no aggregation point, no sorting by creation date across projects, and no programmatic filtering for keys older than a threshold. This approach is error-prone and non-auditable, whereas Cloud Asset Inventory can enumerate every ServiceAccountKey resource at the organization, folder, or project level with a single `gcloud` command.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.