PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A company wants to allow an application running on an on-premises server to access Cloud Storage without using long-lived service account keys. The on-premises environment uses Azure Active Directory (Azure AD) as its identity provider. Which GCP feature should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Workload Identity Federation with Azure AD as an identity provider.
Workload Identity Federation supports Azure AD as an external identity provider. The on-premises app can obtain an Azure AD token and exchange it for a GCP service account token, eliminating the need for keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Service Account Key rotation policy.
Why it's wrong here
Key rotation does not eliminate the need for keys; it only reduces risk.
- ✓
Workload Identity Federation with Azure AD as an identity provider.
Why this is correct
Workload Identity Federation allows keyless authentication using tokens from Azure AD.
- ✗
Create a custom OAuth 2.0 client ID for the application.
Why it's wrong here
OAuth client IDs are for user authentication, not workload identity.
- ✗
Use a VPN between on-premises and GCP, and allow the on-premises server to use a metadata server.
Why it's wrong here
The metadata server is only available on GCP resources.
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.