PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
A security team needs to allow a third-party application running on AWS to access a Cloud Storage bucket without using service account keys. The application already uses AWS IAM roles. Which Google Cloud feature should they use?
⚠ Common exam trap
The Google Cloud exam often tests the misconception that network-level solutions like Cloud VPN or IAP can solve identity and access management problems, but the key requirement here is identity federation, not network connectivity or application-layer proxy access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Workload Identity Federation
Workload Identity Federation allows the AWS application to exchange its AWS IAM role credentials for Google Cloud temporary security tokens, enabling access to Cloud Storage without managing or storing service account keys. This is the correct approach because it directly addresses the requirement to avoid service account keys while leveraging the existing AWS IAM identity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Secret Manager with a service account key
Why it's wrong here
Still uses a key, which is to be avoided.
- ✗
Identity-Aware Proxy (IAP)
Why it's wrong here
IAP controls access to web applications, not workloads from external clouds.
- ✗
Cloud VPN
Why it's wrong here
VPN provides network connectivity, not identity-based access.
- ✓
Workload Identity Federation
Why this is correct
Allows AWS workloads to impersonate a GCP SA using AWS IAM roles without keys.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.