Courseiva
← ACE
Full test
hardMultiple SelectObjective-mapped

Google ACE Practice Question: Which THREE are valid ways to authenticate a user…

Which THREE are valid ways to authenticate a user for gcloud commands? (Choose three.)

⚠ Common exam trap

Google Cloud often tests the misconception that API keys are a valid authentication method for gcloud commands, but API keys only identify projects and are not accepted by gcloud for user or service account authentication.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

OAuth2 access token

An OAuth2 access token can be used to authenticate gcloud commands by passing it with the `--access-token-file` flag or via the `gcloud auth print-access-token` command. This token is obtained from an authorization server and provides temporary, scoped access to Google Cloud resources without requiring a long-lived credential like a service account key.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    API key

    Why it's wrong here

    API keys are project-level identifiers attached to HTTP requests; they are not credentials that represent a user or service account. The gcloud CLI needs identity-based authentication to authorize actions on your behalf, and an API key cannot prove who you are or which permissions you have. Consequently, gcloud explicitly rejects API keys as an authentication method, although they are suitable for simple public API calls that do not require identity.

  • ✓

    OAuth2 access token

    Why this is correct

    An OAuth2 access token is a bearer token that grants access to Google APIs on behalf of a user or service account. After `gcloud auth login`, the CLI stores the access token and refresh token, and it uses the access token in each RPC's Authorization header. You can also generate one programmatically from a service account's credentials or a user's OAuth flow, and then pass it via `gcloud auth` commands, making it a valid authentication method.

  • ✓

    Application Default Credentials

    Why this is correct

    Application Default Credentials (ADC) are automatically resolved by Google client libraries and the gcloud CLI from the environment. ADC is populated by `gcloud auth application-default login` for user credentials, by the GOOGLE_APPLICATION_CREDENTIALS environment variable pointing to a service account key, or by the metadata server when running on Google Cloud. Because gcloud checks ADC when you haven't explicitly set an account, it is a supported and often convenient way to authenticate.

  • ✓

    Service account key file

    Why this is correct

    A service account key file is a JSON file containing a private key and metadata that lets you act as the corresponding service account. The command `gcloud auth activate-service-account --key-file=KEY.JSON` loads this key, which gcloud then uses to sign JWTs and obtain OAuth2 access tokens. This method is ideal for non-interactive automation and CI/CD pipelines, where you need deterministic credentials rather than end-user consent.

  • ✗

    IdP token

    Why it's wrong here

    An IdP token (e.g., a JWT from a third-party identity provider) is used with workload identity federation to exchange for Google-issued credentials via the Security Token Service, not used directly by the gcloud CLI. gcloud expects native credential formats like OAuth2 access tokens, service account keys, or application default credentials. To use an external IdP, you must first set up workload identity federation and call the token exchange API; simply supplying the IdP token to gcloud will not authenticate you.

About these practice questions

One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.