mediumMultiple SelectObjective-mapped
PCSE Practice Question: Is investigating a potential data breach in a…
A security engineer is investigating a potential data breach in a Google Cloud environment. The engineer suspects that a compromised service account key was used to access Cloud Storage buckets. Which TWO actions should the engineer take immediately to mitigate the risk?
⚠ Common exam trap
Google Cloud often tests the distinction between disabling a service account (which stops all access immediately) versus deleting or rotating a key (which may leave other keys or a window of exposure), and candidates mistakenly choose 'rotate the key' thinking it invalidates the old key, but rotation alone does not delete the old key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable the service account
Disabling the service account immediately stops all access using any of its keys, including the compromised one, without deleting the account or its configuration. This is the fastest way to block the attacker while preserving the ability to investigate and re-enable the account later if needed. In Google Cloud, disabling a service account is a reversible action that revokes all authentication and authorization for that identity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disable the service account
Why this is correct
Disabling the service account immediately revokes all access for that account.
- ✗
Revoke all IAM roles granted to the service account
Why it's wrong here
This does not prevent access via the key if the key itself is still valid; the service account still exists.
- ✗
Rotate the service account key
Why it's wrong here
Rotation creates a new key but the old key remains valid until deleted, so immediate risk persists.
- ✓
Delete the compromised service account key
Why this is correct
Deleting the key immediately invalidates it.
- ✗
Enable Cloud Audit Logs for the service account
Why it's wrong here
This helps with investigation but does not mitigate the immediate threat.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.