hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: Your security team requires that all service…
Your security team requires that all service accounts in your GCP organization older than 90 days that have not been used must be automatically disabled. They want a fully managed, serverless solution with no persistent infrastructure. Which architecture best meets these requirements?
⚠ Common exam trap
Google Cloud often tests the misconception that Organization Policies can enforce time-based lifecycle actions on IAM resources, but they only provide static constraints (e.g., 'constraints/iam.disableServiceAccountCreation'), not dynamic expiration or usage-based disabling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Cloud Scheduler to trigger a Cloud Function that queries Cloud Asset Inventory and disables stale service accounts.
Cloud Scheduler can trigger a serverless Cloud Function on a schedule (e.g., nightly) to query Cloud Asset Inventory for service accounts older than 90 days with no last authentication time, then disable them via the IAM API. This meets the fully managed, serverless requirement with no persistent infrastructure (no VMs or servers to maintain).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a Compute Engine VM with a cron job that calls the IAM API nightly.
Why it's wrong here
Deploying a Compute Engine VM to run a cron job that calls the IAM API nightly would technically work, but it introduces a persistent, always-on virtual machine that must be patched, maintained, and monitored. This contradicts the user's implied need for a lightweight, serverless solution. A perpetual VM also incurs continuous cost, even when the job is idle, and represents a larger operational burden compared to a Cloud Scheduler + Cloud Function pipeline that scales to zero.
- ✓
Use Cloud Scheduler to trigger a Cloud Function that queries Cloud Asset Inventory and disables stale service accounts.
Why this is correct
Cloud Scheduler is a fully managed cron service that can invoke an HTTP-triggered Cloud Function on a defined schedule (e.g., nightly or weekly). The Cloud Function can call Cloud Asset Inventory's searchAllResources or searchAllIamPolicies to list service accounts and inspect the `lastAuthenticatedTime` property exposed for service accounts. Using the IAM API, the function can then disable stale accounts via `disableServiceAccount()`. This approach is entirely serverless, event-driven, and requires no persistent compute or manual intervention, making it the most efficient and aligned with Google Cloud best practices.
- ✗
Configure an org policy that automatically expires service accounts after 90 days.
Why it's wrong here
Google Cloud Organization Policies (constraints) do not include any native constraint that automatically expires or disables service accounts after a period of inactivity. While custom constraints via CEL can enforce some resource configurations, they cannot trigger time-based lifecycle actions like disabling an IAM principal based on `lastAuthenticatedTime`. Building such behavior would require a custom controller or notification system, so this option is not a native or supported solution.
- ✗
Use Security Command Center to flag and manually disable unused service accounts.
Why it's wrong here
Security Command Center (SCC) can, through detectors like anomaly detection and event threat detection, generate findings related to inactive service accounts or suspicious activity. However, SCC findings are primarily informational and require a security analyst to triage, investigate, and manually disable the service account using the Console or gcloud. It does not provide built-in automated remediation; any automation would need to be layered on top, so it does not satisfy the requirement of automatically disabling unused accounts without human effort.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Serverless
Serverless is a cloud computing model where the cloud provider manages the servers, and you only pay for the actual compute time your code uses, without having to worry about provisioning or maintaining infrastructure.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.