PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A GKE cluster has Workload Identity enabled. A Kubernetes service account is bound to a GCP service account named 'sa-gcs'. A pod using the Kubernetes service account fails to list objects in a Cloud Storage bucket. The GCP service account has the Storage Object Viewer role. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Kubernetes service account does not have the iam.workloadIdentityUser role on the GCP service account.
The pod must use the Kubernetes service account, but the GCP service account may not have the required permission (storage.objects.list). However, with Workload Identity, the pod authenticates as the GCP SA. The issue could be that the GCP SA does not have the role on the specific bucket, or the binding is misconfigured. But the most common cause is missing the iam.workloadIdentityUser role on the GCP SA for the Kubernetes service account to impersonate it. Without that, the pod cannot use the GCP SA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The pod is using the wrong GCP service account.
Why it's wrong here
If bound correctly, the pod uses the correct SA.
- ✗
The bucket has uniform bucket-level access disabled.
Why it's wrong here
Uniform bucket-level access does not affect permission errors.
- ✓
The Kubernetes service account does not have the iam.workloadIdentityUser role on the GCP service account.
Why this is correct
This role is required for the KSA to impersonate the GCP SA.
- ✗
The GCP service account lacks the storage.objects.list permission.
Why it's wrong here
Storage Object Viewer includes that permission.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.