PCSE Practice Question: Configuring Access Within a Cloud Solution Environment

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use the Compute Engine default service account and grant it the roles/storage.objectViewer role.

  Why this is correct

  The default service account is automatically attached to the VM. Granting it the Storage role allows the VM to read objects without key management.

• ✗

  Create a service account key, download it to the VM, and use it with gcloud auth.

  Why it's wrong here

  Avoid using service account keys on VMs. They pose a security risk. The default service account is preferred.

• ✗

  Add the user's personal credentials to the VM and use them.

  Why it's wrong here

  Personal credentials should not be used on VMs. Use a service account instead.

• ✗

  Use Application Default Credentials (ADC) from a service account key stored in Secret Manager.

  Why it's wrong here

  Using a service account key, even one stored in Secret Manager, directly contradicts the requirement to authenticate *without managing keys*. Compute Engine VMs are designed to use an attached service account, allowing Application Default Credentials (ADC) to automatically obtain credentials from the instance metadata service, thus eliminating explicit key management. This option is tempting because Secret Manager is the correct service for securely storing and accessing secrets. It would be appropriate for applications running outside Google Cloud or in scenarios where a VM cannot leverage its inherent identity.

Go deeper

Related to this question