PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A company wants to implement workload identity federation for a GitHub Actions workflow, allowing it to access Google Cloud resources without using service account keys. Which three steps are required? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a service account in GCP and grant it the necessary roles.
To implement workload identity federation for GitHub Actions, you need to: create a service account with necessary roles (C), create a workload identity pool and provider for GitHub (D), and configure the GitHub Actions workflow to authenticate using the provider (E). Option A is incorrect because the role `roles/iam.workloadIdentityUser` is granted on the service account, not on the pool. Option B is incorrect because storing a JSON key defeats the purpose of workload identity federation, which avoids using service account keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant the service account the roles/iam.workloadIdentityUser role on the workload identity pool.
Why it's wrong here
The correct role is roles/iam.workloadIdentityUser, but it is granted on the service account, not the pool. Actually, the permission is granted on the service account for impersonation.
- ✗
Generate a JSON key for the service account and store it as a GitHub secret.
Why it's wrong here
Keys are to be avoided; workload identity federation replaces keys.
- ✓
Create a service account in GCP and grant it the necessary roles.
Why this is correct
A service account is needed as the target identity.
- ✓
Create a workload identity pool and provider in GCP for GitHub Actions.
Why this is correct
The pool and provider define the trust relationship with GitHub.
- ✓
Configure GitHub Actions workflow to authenticate using the workload identity provider.
Why this is correct
The workflow needs to use the provider to obtain tokens.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.