PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A company has an organization policy that disables service account key creation (constraints/iam.disableServiceAccountKeyCreation). However, a legacy application requires a service account key to authenticate. What should the engineer do to satisfy this requirement while following best practices?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use workload identity federation to authenticate the legacy application without keys
The best practice is to avoid service account keys entirely. Use workload identity federation if the application runs outside GCP, or use Workload Identity for GKE if it runs in GKE. If the application must use keys, you can request an exception by creating a custom organization policy with a condition or by using the policy simulator to test, but the preferred approach is to eliminate key usage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a service account key and use it despite the policy, then document the exception
Why it's wrong here
The organization policy prevents key creation; attempting to bypass it is not compliant.
- ✓
Use workload identity federation to authenticate the legacy application without keys
Why this is correct
Workload identity federation allows keyless authentication from external workloads, meeting the requirement without violating the policy.
- ✗
Create a custom role that includes iam.serviceAccountKeys.create and assign it to the service account
Why it's wrong here
Even with permission, the organization policy blocks key creation; this would fail.
- ✗
Remove the organization policy constraint to allow key creation
Why it's wrong here
Removing a security policy is not best practice; there are alternative approaches.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.