PCSE Practice Question: Configuring Access Within a Cloud Solution Environment
An organization wants to allow an external identity provider (IdP) that supports OpenID Connect (OIDC) to access GCP resources. They want to avoid creating and managing service account keys. What should they use?
⚠ Common exam trap
Many candidates confuse Cloud Identity Platform (which is for end-user federation) with Workload Identity Federation (which is for non-human workloads like external IdPs), leading them to pick Option A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Workload Identity Federation to allow the external IdP to impersonate a service account.
Workload Identity Federation allows an external identity provider (IdP) that supports OpenID Connect (OIDC) to impersonate a GCP service account without requiring service account keys. This enables the external IdP to obtain short-lived, scoped tokens directly from GCP, eliminating the need to create, store, or rotate long-lived keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Cloud Identity Platform to federate the external IdP.
Why it's wrong here
Cloud Identity Platform is for customer-facing applications, not for workload access to GCP resources.
- ✗
Create a service account key and share it with the external IdP.
Why it's wrong here
Sharing keys is insecure and against best practices.
- ✗
Use a VPN tunnel to connect the external IdP to GCP and use internal IPs.
Why it's wrong here
VPN does not solve identity federation; it only provides network connectivity.
- ✓
Configure Workload Identity Federation to allow the external IdP to impersonate a service account.
Why this is correct
Workload Identity Federation enables keyless authentication for workloads running outside GCP.
Go deeper
Related to this question
About these practice questions
One of 960 original PCSE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.