mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: A developer needs to use Application Default…
A developer needs to use Application Default Credentials (ADC) in a local development environment to call the Cloud Translation API. They have already run `gcloud auth login`. What additional step is required to make ADC work correctly?
⚠ Common exam trap
Google Cloud often tests the distinction between `gcloud auth login` (for CLI authentication) and `gcloud auth application-default login` (for ADC), leading candidates to mistakenly think the former is sufficient for ADC-based API calls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run `gcloud auth application-default login` to generate ADC credentials.
`gcloud auth application-default login` creates a special credential file (typically at `~/.config/gcloud/application_default_credentials.json`) that Application Default Credentials (ADC) uses to authenticate API calls. While `gcloud auth login` sets up user credentials for gcloud CLI commands, ADC does not use those credentials directly; it requires its own separate credential file. Running this command ensures that the local development environment can authenticate to the Cloud Translation API via ADC without additional configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run `gcloud auth application-default login` to generate ADC credentials.
Why this is correct
`gcloud auth application-default login` is the canonical command for locally developing with Google Cloud client libraries because it downloads OAuth2 user credentials and stores them in `application_default_credentials.json` in the well-known gcloud config directory. This file is one of the primary sources in the ADC lookup chain, so client libraries automatically discover these credentials without any further configuration. Unlike `gcloud auth login`, which only authenticates the gcloud CLI, this command specifically populates the credentials that your application code will find when it calls the ADC helper.
- ✗
Set the `GOOGLE_CLOUD_PROJECT` environment variable to the project ID.
Why it's wrong here
Setting the `GOOGLE_CLOUD_PROJECT` environment variable only informs client libraries which project ID to use for operations, but it provides no secret, token, or key material for authentication. The library still needs valid Application Default Credentials (ADC)—either from `application_default_credentials.json` or another ADC source—to sign requests and authorize API calls. This variable might be necessary alongside correct credentials, but it cannot replace them. Without ADC, the client library will fail with an unauthenticated error even if the project is set correctly.
- ✗
Download a service account JSON key and set `GOOGLE_APPLICATION_CREDENTIALS`.
Why it's wrong here
Using a service account JSON key and `GOOGLE_APPLICATION_CREDENTIALS` overrides the credential chain; after `gcloud auth login`, ADC already uses the authenticated user’s OAuth2 tokens. This step is unnecessary locally and disrupts the intended automatic user-based authentication. It is tempting because service account keys are the standard, portable method for environments without a pre-authenticated user session, such as production servers or CI/CD pipelines, where ADC would otherwise have no credentials.
- ✗
Run `gcloud config set account` to switch to the correct account.
Why it's wrong here
`gcloud config set account` merely changes the active identity for the gcloud CLI's own operations, updating the config file under `~/.config/gcloud/configurations`. It does not touch or create the separate `application_default_credentials.json` file that Application Default Credentials (ADC) uses for client libraries. The ADC lookup chain never reads the active gcloud account setting; it checks the credentials file or metadata server independently. Consequently, even after this command, the client library still has no credentials and will raise an authentication error.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Cloud Translation
Cloud Translation is a managed service that uses machine learning to dynamically translate text between languages over the internet.
Key term
Application Default Credentials
Application Default Credentials (ADC) is a built-in Google Cloud mechanism that automatically finds and provides the right credentials for your application to authenticate to Google Cloud services without hardcoding secrets.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.