PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A developer wants to run a containerized application on GKE that needs to read from a Cloud Storage bucket. The developer needs to securely provide credentials. What is the recommended approach?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Google service account with necessary permissions, create a Kubernetes service account, and configure Workload Identity to bind them.
The recommended approach is to use Workload Identity to bind a Kubernetes service account to a Google service account. This avoids managing keys and allows fine-grained access. The developer should create a GCP service account with the Storage Object Viewer role, then create a Kubernetes service account, and bind them using Workload Identity. The pod should use the Kubernetes service account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Google service account with necessary permissions, create a Kubernetes service account, and configure Workload Identity to bind them.
Why this is correct
Workload Identity allows pods to use GCP service accounts without keys, following best practices.
- ✗
Use the default compute engine service account for the GKE nodes.
Why it's wrong here
This would give the pod access to the node's service account, which is overly permissive and not recommended.
- ✗
Store the service account key in Cloud Secret Manager and retrieve it in the pod at startup.
Why it's wrong here
While better than storing in Kubernetes secrets, this still requires key management; Workload Identity is preferred.
- ✗
Create a service account key, store it as a Kubernetes secret, and mount it in the pod.
Why it's wrong here
Using service account keys is discouraged due to security risks; Workload Identity is the recommended method.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.