Service Account Long Running Workloads

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise operates automated, long-running data processing pipelines deployed across Compute Engine instances and Google Kubernetes Engine (GKE) clusters. These workloads continuously ingest data from Cloud Storage buckets and write analytics results into BigQuery datasets without end-user interaction. The security team previously discovered that some pipelines failed because they relied on human developer credentials that were suspended during employee offboarding.

Which identity architecture should the organization implement to ensure stable, long-term authorization independent of user account lifecycles while enforcing the principle of least privilege?

Generate user-managed service account JSON keys with the Owner role, store them in the VM filesystem, and pass the keys into container environment variables.

Create individual Cloud Identity corporate user accounts for each automated workload, bypass multi-factor authentication policies, and assign them project-level IAM roles.

Provision dedicated user-managed service accounts for each workload, attach them to the Compute Engine instances, configure Workload Identity Federation for GKE pods, and assign granular IAM roles.

Rely on the Compute Engine default service account across all VMs and GKE nodes with its default Editor role to handle API authorization across projects.

Professional Cloud Security Engineer

Service Account Long Running Workloads

Related questions