PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
An application running on Compute Engine needs to authenticate to Google Cloud APIs. The security engineer wants to avoid managing keys. What is the recommended method?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach a service account to the VM instance and use the metadata server to obtain tokens.
Use the default compute engine service account or a custom service account attached to the VM instance. The VM automatically obtains tokens via the metadata server, no keys required. This is the recommended approach for workloads on Compute Engine.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the service account key in Cloud Secret Manager and retrieve it at boot.
Why it's wrong here
Storing a service account key in Cloud Secret Manager still requires the application to handle a long-lived private key, which contradicts the security engineer’s requirement to avoid managing keys entirely. This approach is tempting because Cloud Secret Manager is designed to securely store secrets, and it would be the correct choice if the application needed to retrieve a key for legacy authentication that cannot use workload identity federation.
- ✗
Create a service account key and store it in the instance's local disk.
Why it's wrong here
Managing keys is insecure and not recommended; the metadata server provides a better method.
- ✗
Use workload identity federation to exchange a JWT from the application.
Why it's wrong here
Workload identity federation is for workloads outside GCP, not for Compute Engine VMs.
- ✓
Attach a service account to the VM instance and use the metadata server to obtain tokens.
Why this is correct
This is the recommended approach; no keys are needed, and the service account is securely attached to the VM.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.