Google PCA Design for security and compliance Practice Question
A company is deploying a web application on Google Kubernetes Engine (GKE) and needs to ensure that the application's service account can only pull images from a specific Container Registry repository. What is the best practice to enforce this?
⚠ Common exam trap
A common mix-up: candidates confuse node-level service accounts (like the Compute Engine default service account) with application-level service accounts, assuming that granting permissions to the node's service account is sufficient, when in fact it grants overly broad access to all pods on the node.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Workload Identity and grant the Kubernetes service account's associated Google service account the roles/storage.objectViewer role on the registry bucket.
Workload Identity allows you to map a Kubernetes service account to a Google service account and grant that Google service account the roles/storage.objectViewer role on the specific Container Registry bucket. This ensures that only pods using that Kubernetes service account can pull images from the designated repository, following the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Workload Identity and grant the Kubernetes service account's associated Google service account the roles/storage.objectViewer role on the registry bucket.
Why this is correct
Workload Identity binds pod identity to a GSA, and bucket-level IAM restricts access.
- ✗
Grant the Compute Engine default service account the roles/storage.objectViewer role on the registry bucket.
Why it's wrong here
The default service account is used by all compute instances, too broad.
- ✗
Set an IAM policy on the pod directly using the 'gke-default' service account.
Why it's wrong here
Pods do not have direct IAM policies; they inherit from the node or use Workload Identity.
- ✗
Create an IAM condition on the node pool's service account that limits access to the registry bucket.
Why it's wrong here
Node pool service account is used by all pods on the nodes, not specific to the application.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Google Kubernetes Engine
Google Kubernetes Engine (GKE) is a managed Kubernetes service on Google Cloud that lets you deploy, scale, and manage containerized applications without having to operate the underlying cluster control plane.
Key term
Workload Identity
A workload identity is a digital credential assigned to an application, service, or automated process that proves its identity to other systems without requiring a human user to log in.
About these practice questions
This PCA question is part of Courseiva's 955-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.