Google PCA Designing for Security and Compliance Practice Question
A company needs to ensure that only applications running in a specific GKE namespace can access a Cloud Storage bucket. Which approach should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Workload Identity to bind the Kubernetes service account to a GCP service account with appropriate IAM roles
Workload Identity allows binding a Kubernetes service account to a GCP service account. Then, IAM can be granted to that GCP service account for the Cloud Storage bucket.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Workload Identity to bind the Kubernetes service account to a GCP service account with appropriate IAM roles
Why this is correct
Workload Identity allows mapping a KSA to a GSA, enabling fine-grained access control based on namespace.
- ✗
Use VPC Service Controls to restrict the bucket to only the GKE cluster's VPC
Why it's wrong here
VPC Service Controls restrict based on network, not namespace.
- ✗
Use firewall rules to allow traffic only from the GKE cluster's pod CIDR
Why it's wrong here
Firewall rules cannot distinguish between namespaces.
- ✗
Use Cloud Armor to restrict access based on source IP
Why it's wrong here
Cloud Armor is for HTTP(S) load balancers, not Cloud Storage access.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Service account
A service account is a special type of account used by an application or a virtual machine, rather than a human user, to authenticate and interact with cloud services and APIs securely.
About these practice questions
One of 955 original PCA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.