PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A company is using GKE with Workload Identity to allow pods to access Google Cloud services. A security engineer needs to restrict a specific pod to only read from a single Cloud Storage bucket. Which THREE steps should be taken? (Choose 3 correct answers)
⚠ Common exam trap
The PCSE exam often tests the distinction between project-level and resource-level IAM bindings; the trap here is that candidates may think granting a role at the project level is sufficient, but the requirement to restrict access to a single bucket demands a bucket-level binding.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Kubernetes service account (KSA) in the pod's namespace.
Workload Identity requires a Kubernetes Service Account (KSA) to be associated with a pod. The KSA is annotated with the email of a Google Cloud Service Account (GCP SA), and the pod uses the KSA to authenticate. This creates a direct identity binding between the pod and the GCP SA, enabling fine-grained access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Kubernetes service account (KSA) in the pod's namespace.
Why this is correct
A KSA is needed to be bound to the GCP SA.
- ✗
Grant the GCP SA roles/storage.objectViewer at the project level.
Why it's wrong here
Project-level grant gives access to all buckets in the project, violating least privilege.
- ✗
Create a custom role with storage.objects.get and storage.objects.list, and assign to the GCP SA.
Why it's wrong here
While custom role is good, step C is incorrect because it's at project level. If we consider resource-level binding, this custom role would still need to be bound to the bucket. The existing options are about the role and scope; A already covers the correct scope.
- ✓
Create a Google service account (GCP SA) with roles/storage.objectViewer, and bind it to the bucket using resource-level IAM.
Why this is correct
This restricts the GCP SA to only that bucket.
- ✓
Annotate the KSA with the GCP SA email (iam.gke.io/gcp-service-account).
Why this is correct
This binds the KSA to the GCP SA, enabling workload identity.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.