The answer is to use Cloud Asset Inventory to list service account keys, then run a Cloud Scheduler job that invokes a Cloud Function to check key ages and send notifications. This is correct because Cloud Asset Inventory provides a scalable, queryable snapshot of all IAM resources, including service account keys and their creation timestamps, without repeatedly polling the IAM API. The Cloud Scheduler triggers the serverless Cloud Function on a schedule, which efficiently evaluates key age against the 90-day threshold and sends alerts via email or Slack. On the Google Professional Cloud Security Engineer exam, this scenario tests your understanding of combining serverless audit and notification services for automated key rotation detection, a common requirement for compliance. A frequent trap is choosing a solution that uses the IAM API directly with a cron job, which is less efficient and more complex. Memory tip: think “Inventory + Scheduler + Function” as the serverless triad for automated key lifecycle detection.
PCSE Practice Question: Managing operations in a cloud solution environment
This PCSE practice question tests your understanding of managing operations in a cloud solution environment. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is migrating to Google Cloud and wants to ensure that all service account keys are rotated automatically every 90 days. The security engineer needs to implement a solution that detects keys older than 90 days and notifies the security team. What is the most efficient way to achieve this?
Use Cloud Monitoring to query the IAM API for key creation timestamps and trigger an alert
Why wrong: Cloud Monitoring does not natively query IAM APIs; it uses metrics.
B
Use Cloud Asset Inventory to list service account keys, then run a Cloud Scheduler job that invokes a Cloud Function to check key ages and send notifications
This combination efficiently checks key ages periodically and alerts.
C
Create a log-based metric for service account key creation and set up an alert in Cloud Monitoring
Why wrong: This only monitors new key creation, not key age.
D
Configure a custom role in Cloud IAM that denies access to keys older than 90 days
Why wrong: IAM roles cannot enforce key rotation; they only control permissions.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Cloud Asset Inventory to list service account keys, then run a Cloud Scheduler job that invokes a Cloud Function to check key ages and send notifications
Option B is correct because Cloud Asset Inventory can list all service account keys and their creation timestamps, and a Cloud Scheduler job can trigger a Cloud Function to check key ages against the 90-day threshold and send notifications via email or Slack. This approach is efficient as it uses serverless components and avoids polling the IAM API repeatedly, which would be less scalable and more complex.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Use Cloud Monitoring to query the IAM API for key creation timestamps and trigger an alert
Why it's wrong here
Cloud Monitoring does not natively query IAM APIs; it uses metrics.
✓
Use Cloud Asset Inventory to list service account keys, then run a Cloud Scheduler job that invokes a Cloud Function to check key ages and send notifications
Why this is correct
This combination efficiently checks key ages periodically and alerts.
Related concept
Read the scenario before looking for a memorised answer.
✗
Create a log-based metric for service account key creation and set up an alert in Cloud Monitoring
Why it's wrong here
This only monitors new key creation, not key age.
✗
Configure a custom role in Cloud IAM that denies access to keys older than 90 days
Why it's wrong here
IAM roles cannot enforce key rotation; they only control permissions.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Google Cloud often tests the distinction between detecting key creation events (Option C) and detecting key age, leading candidates to mistakenly choose a log-based metric that only triggers on creation, not on the passage of time.
Detailed technical explanation
How to think about this question
Cloud Asset Inventory provides a real-time snapshot of IAM resources, including service account keys, with their `validAfterTime` and `validBeforeTime` fields. A Cloud Function can parse these timestamps, compute age using Python's `datetime` module, and trigger notifications via Pub/Sub or SendGrid. In practice, this solution scales to thousands of keys without manual intervention, unlike polling the IAM API which has rate limits (e.g., 1,500 requests per minute per project).
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Managing operations in a cloud solution environment — This question tests Managing operations in a cloud solution environment — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use Cloud Asset Inventory to list service account keys, then run a Cloud Scheduler job that invokes a Cloud Function to check key ages and send notifications — Option B is correct because Cloud Asset Inventory can list all service account keys and their creation timestamps, and a Cloud Scheduler job can trigger a Cloud Function to check key ages against the 90-day threshold and send notifications via email or Slack. This approach is efficient as it uses serverless components and avoids polling the IAM API repeatedly, which would be less scalable and more complex.
What should I do if I get this PCSE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.