Google PCA Manage and provision cloud infrastructure Practice Question
Which THREE are required to configure Workload Identity for a GKE cluster? (Choose 3)
⚠ Common exam trap
Google Cloud often tests the distinction between Kubernetes RoleBinding (for RBAC) and IAM policy binding (for Workload Identity), leading candidates to incorrectly select a RoleBinding as the binding mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Google Cloud service account
A Google Cloud service account (GSA) is required to authenticate to Google Cloud APIs from within GKE. Workload Identity maps a Kubernetes service account (KSA) to a GSA, allowing pods to inherit the GSA's IAM permissions without managing static keys. The GSA must be created first to define the identity that workloads will assume.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Google Cloud service account
Why this is correct
The GSA is used to grant permissions to the Kubernetes service account.
- ✓
Create a Kubernetes service account
Why this is correct
The KSA represents the application's identity in the cluster.
- ✓
Enable Workload Identity on the GKE cluster
Why this is correct
Workload Identity must be enabled at cluster creation or update.
- ✗
Bind the Kubernetes service account to the Google Cloud service account using a Kubernetes RoleBinding
Why it's wrong here
The binding must be an IAM policy binding, not a Kubernetes RoleBinding.
- ✗
Use a node pool that has Workload Identity enabled
Why it's wrong here
Workload Identity can be used with any node pool if the cluster is enabled.
Go deeper
Related to this question
Learn chapter
Google Kubernetes Engine (GKE)
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
Service account
A service account is a special type of account used by an application or a virtual machine, rather than a human user, to authenticate and interact with cloud services and APIs securely.
About these practice questions
One of 807 original PCA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.