Google PCA Designing for Security and Compliance Practice Question
A developer wants to allow a Compute Engine VM to authenticate to Google Cloud APIs without embedding service account keys in the VM image. What is the recommended approach?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach a service account to the VM instance
Attaching a service account to the Compute Engine VM allows it to automatically obtain credentials via the metadata server, avoiding key management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Cloud KMS to encrypt a service account key and store it in a bucket
Why it's wrong here
While better than plaintext, this still requires key handling and is not the recommended approach.
- ✗
Use a service account impersonation flow
Why it's wrong here
Impersonation requires an initial credential, which would need to be provided.
- ✓
Attach a service account to the VM instance
Why this is correct
The VM can then use the default service account credentials via the metadata server.
- ✗
Create a service account key and store it in the VM's startup script
Why it's wrong here
Embedding keys is insecure and not recommended.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Image
An image is a complete snapshot of a system's operating system, applications, and settings, used to deploy or restore computing environments quickly.
Key term
Compute Engine
Compute Engine is Google Cloud's Infrastructure-as-a-Service (IaaS) offering that lets you create and run virtual machines on Google's infrastructure.
About these practice questions
This PCA question is part of Courseiva's 955-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.