PCSE Practice Question: Configuring access within a cloud solution environment
This PCSE practice question tests your understanding of configuring access within a cloud solution environment. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which two authentication methods are available for applications to authenticate to Google Cloud APIs without using a service account key? (Choose TWO.)
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compute Engine metadata server default service account token
Option B is correct because the Compute Engine metadata server provides a default service account token that applications running on Compute Engine can use to authenticate to Google Cloud APIs without needing to manage a service account key file. This token is automatically obtained from the metadata server at http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token, and it is rotated automatically by Google, eliminating the need for key storage and rotation.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
API key
Why it's wrong here
API keys are used for identifying projects, not for authenticating an application's identity.
✓
Compute Engine metadata server default service account token
Why this is correct
Instances can use the default service account to get tokens without keys.
Related concept
Read the scenario before looking for a memorised answer.
✗
OAuth 2.0 client ID
Why it's wrong here
OAuth 2.0 client IDs are for user-facing applications, not for server-to-server authentication.
✓
Workload Identity Federation
Why this is correct
Enables on-premises or multi-cloud workloads to authenticate without keys.
Related concept
Read the scenario before looking for a memorised answer.
✗
Service account key
Why it's wrong here
Service account keys are explicitly what we want to avoid.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Google Cloud often tests the distinction between methods that require a key (service account key, OAuth 2.0 client secret) and those that do not (metadata server, Workload Identity Federation), and the trap here is that candidates may incorrectly select API key or OAuth 2.0 client ID because they are familiar with them for user authentication, but they do not satisfy the 'without using a service account key' condition for application-to-API authentication.
Detailed technical explanation
How to think about this question
Workload Identity Federation (Option D) allows workloads running outside Google Cloud (e.g., on AWS, Azure, or on-premises) to exchange external identity tokens for Google Cloud service account tokens without storing a service account key, using the Security Token Service (STS) and the IAMCredentials API. The metadata server token (Option B) is obtained via a simple HTTP GET request to a well-known endpoint and includes an access token scoped to the service account's roles, with automatic rotation every 60 minutes by default. Both methods avoid the security risk of long-lived keys, which are a common attack vector if leaked.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Configuring access within a cloud solution environment — This question tests Configuring access within a cloud solution environment — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Compute Engine metadata server default service account token — Option B is correct because the Compute Engine metadata server provides a default service account token that applications running on Compute Engine can use to authenticate to Google Cloud APIs without needing to manage a service account key file. This token is automatically obtained from the metadata server at http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token, and it is rotated automatically by Google, eliminating the need for key storage and rotation.
What should I do if I get this PCSE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.