PCDOE Practice Question: Bootstrapping a Google Cloud organization for DevOps
A company is bootstrapping their Google Cloud organization for DevOps. They want to implement a least-privilege model for service accounts used by CI/CD pipelines. The pipelines need to deploy resources in multiple projects. What is the best practice for managing service account keys?
⚠ Common exam trap
Google Cloud often tests the misconception that storing keys in a secure vault like Secret Manager is the best practice, but the trap here is that any long-lived key — even if encrypted at rest — introduces a persistent secret that can be exfiltrated, whereas workload identity federation eliminates the key entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use workload identity federation to allow the CI/CD system to impersonate a service account without keys.
Workload identity federation allows an external CI/CD system (e.g., Jenkins, GitHub Actions) to impersonate a Google Cloud service account without managing or storing any long-lived keys. This eliminates the security risk of key leakage and aligns with the least-privilege principle by enabling short-lived, scoped credentials via the Security Token Service (STS) and OAuth 2.0 token exchange.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a user account for the CI/CD pipeline and assign it the necessary roles.
Why it's wrong here
User accounts are not recommended for automation.
- ✗
Store service account keys in Secret Manager and have the pipeline retrieve them at runtime.
Why it's wrong here
Still uses a key, albeit stored securely.
- ✗
Generate a single service account key and securely distribute it to the CI/CD system.
Why it's wrong here
Long-lived keys are a security risk.
- ✓
Use workload identity federation to allow the CI/CD system to impersonate a service account without keys.
Why this is correct
Eliminates the need for keys and follows least privilege.
Go deeper
Related to this question
About these practice questions
One of 486 original PCDOE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCDOE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCDOE exam.