Google PCA Practice Question: Managing and Provisioning a Solution Infrastructure
A company has a GKE cluster with Workload Identity enabled. A pod needs to access a BigQuery dataset in a different project. The team has created a service account in the pod's project and granted it BigQuery Data Viewer on the dataset. They also created an IAM policy binding between the Kubernetes service account and the Google service account. The pod still gets permission denied. What is missing?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Google service account needs the iam.workloadIdentityUser role on itself
Workload Identity requires the Google service account to be granted the iam.workloadIdentityUser role on the Google service account itself, not just on the Kubernetes service account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The Google service account needs the iam.workloadIdentityUser role on itself
Why this is correct
This role allows the Kubernetes service account to impersonate the Google service account.
- ✗
The Kubernetes service account needs the iam.workloadIdentityUser role
Why it's wrong here
The role is on the Google service account, not the Kubernetes SA.
- ✗
The pod needs a node pool with Workload Identity enabled
Why it's wrong here
Workload Identity is enabled at the cluster level, not per node pool.
- ✗
The BigQuery dataset must be in the same project as the cluster
Why it's wrong here
Cross-project access is supported with proper IAM.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Service account
A service account is a special type of account used by an application or a virtual machine, rather than a human user, to authenticate and interact with cloud services and APIs securely.
Key term
Pod
A pod is the smallest deployable unit in Kubernetes, containing one or more containers that share storage, network, and a specification for how to run.
About these practice questions
This PCA question is part of Courseiva's 955-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.