Google ACE Configuring Access and Security Practice Question
An organization uses Secret Manager to store database credentials. A new application runs on Compute Engine and needs to access a secret. The application uses the default compute engine service account. What is the most secure way to grant access to the secret?
⚠ Common exam trap
The trap is choosing an option that creates a service account key or uses a broad role, when the exam-tested best practice is to grant the narrow secretAccessor role to the existing attached service account.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant the roles/secretmanager.secretAccessor role to the compute engine default service account
The most secure way is to grant the roles/secretmanager.secretAccessor role directly to the Compute Engine default service account, leveraging the instance's attached identity. This avoids long-lived credentials, uses IAM for least-privilege access, and lets the application call the Secret Manager API via the metadata server. No keys are stored on disk, and access is auditable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcode the secret in the application configuration file
Why it's wrong here
Hardcoding a secret into a configuration file stores it in plaintext, making it visible to anyone with read access to the application's source code or filesystem. This approach also lacks audit logging, versioning, and automatic rotation, leaving the credential valid indefinitely if not manually changed. It violates the principle of least privilege and increases the blast radius of a leak.
- ✗
Create a new service account with the secretAccessor role, create a key, and store it on the instance
Why it's wrong here
Creating a new service account and downloading a key file to store on the instance exposes a long-lived, static credential that can be stolen or accidentally committed to source control. The default Compute Engine service account already has an identity tied to the instance via the metadata server, enabling short-lived OAuth2 tokens without any key material on disk. This option needlessly introduces key management overhead and a persistent security risk.
- ✗
Grant the roles/editor role to the default compute engine service account
Why it's wrong here
The Editor role grants extensive permissions across all resources in the project, including the ability to create, modify, and delete Compute Engine instances, Cloud Storage objects, and even Secret Manager secrets. This far exceeds what the application needs and violates least privilege, potentially allowing an attacker who compromises the instance to perform destructive actions on the entire project. In particular, it would allow modifying IAM policies or deleting the very secrets the application relies on.
- ✓
Grant the roles/secretmanager.secretAccessor role to the compute engine default service account
Why this is correct
Granting the roles/secretmanager.secretAccessor role to the Compute Engine default service account is the correct approach because it gives the instance's identity the minimum permission needed to access secret versions. The instance authenticates through the metadata server, so no long-lived keys are stored on the instance. This makes it the most secure and operationally simple method, and it aligns with Google's recommended practice of using IAM roles on service accounts rather than embedding credentials.
Go deeper
Related to this question
Learn chapter
Persistent Disk Types: SSD, Balanced, Standard
Key term
Secret Manager
A Secret Manager is a centralized tool that securely stores, manages, and controls access to sensitive information like passwords, API keys, and certificates, often automating their rotation and injection into applications.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
This ACE question is part of Courseiva's 775-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.