hardMultiple ChoiceObjective-mapped
PCSE Practice Question: A financial services company runs a sensitive…
A financial services company runs a sensitive application on Google Kubernetes Engine (GKE) with Workload Identity enabled. Security policy requires that only pods with a specific service account can access a Cloud Storage bucket containing customer data. The bucket has uniform bucket-level access enabled. What is the correct combination of IAM bindings to achieve this?
⚠ Common exam trap
Google Cloud often tests the distinction between Kubernetes service accounts and Google service accounts, trapping candidates who try to bind a KSA directly to a Google Cloud resource instead of using the linked GSA via Workload Identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Bind the Google service account (linked to the Kubernetes service account via Workload Identity) to the bucket IAM policy with roles/storage.objectViewer
Workload Identity links a Kubernetes service account (KSA) to a Google service account (GSA). When a pod uses that KSA, it authenticates as the linked GSA. Since the bucket has uniform bucket-level access, IAM permissions must be granted directly on the bucket resource, not at the project level. Binding the GSA to the bucket with roles/storage.objectViewer ensures only pods using that specific KSA can read the bucket.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add the Google service account as a member of the bucket with roles/storage.objectViewer
Why it's wrong here
IAM bindings are defined on the resource (bucket) and specify members and roles; 'add member' is not a standard IAM operation.
- ✓
Bind the Google service account (linked to the Kubernetes service account via Workload Identity) to the bucket IAM policy with roles/storage.objectViewer
Why this is correct
This is the correct approach: the GSA is granted the role, and pods using the mapped KSA inherit that access.
- ✗
Grant the Google service account roles/storage.objectViewer at the project level
Why it's wrong here
Project-level access would allow all pods in the project to access the bucket, violating the principle of least privilege.
- ✗
Bind the Kubernetes service account to the bucket IAM policy with roles/storage.objectViewer
Why it's wrong here
Kubernetes service accounts cannot be directly used in Google Cloud IAM; they must be mapped to a Google service account via Workload Identity.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.