Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An enterprise development team is building a microservices application that interacts programmatically with Google Cloud APIs, including BigQuery and Cloud Storage. The application codebase is deployed across multiple environments: developer workstations for local testing, Compute Engine instances for staging, and Google Kubernetes Engine (GKE) clusters for production.
The security architecture requires eliminating the risks associated with downloadable, long-lived service account keys and ensuring least privilege access across each deployment tier without code changes.
Which identity and authentication strategy should the team implement?
Configure the application to use Application Default Credentials (ADC) via official client libraries, using user credentials via gcloud auth application-default login locally, attached IAM service accounts on Compute Engine, and Workload Identity on GKE.
Create a centralized IAM service account, generate a downloadable JSON key file, and configure the GOOGLE_APPLICATION_CREDENTIALS environment variable pointing to the file across all environments.
Grant service agent roles directly to user accounts and compute instances, and enable default project-wide API access scopes across all environments.
Embed OAuth 2.0 refresh tokens directly inside application container images and deploy an internal token-vending proxy to exchange them for long-lived access tokens.
Configure the application to use Application Default Credentials (ADC) via official client libraries, using user credentials via gcloud auth application-default login locally, attached IAM service accounts on Compute Engine, and Workload Identity on GKE.
Application Default Credentials (ADC) is a flexible authentication mechanism provided by Google Cloud client libraries that automatically detects credentials based on the application's runtime environment. Instead of requiring hardcoded paths or static tokens, ADC searches a predefined order of locations—such as local user configuration, environment variables, or platform metadata services—to seamlessly acquire short-lived OAuth 2.0 access tokens.
StudyCerts
StudyCertsStorageClient(), BigQueryClient()), which transparently invoke ADC across developer machines, VMs, and Kubernetes pods.gcloud auth application-default login with bounded developer roles, Compute Engine VMs use attached service accounts via the instance metadata server, and GKE workloads leverage Workload Identity to bind Kubernetes Service Accounts (KSAs) to specific Google Service Accounts (GSAs).ADC combined with platform-native identity binding (Compute Engine metadata service and GKE Workload Identity) adheres directly to Google Cloud security best practices. It avoids secret leakage vectors associated with static files while automating credential discovery and token refresh lifecycles without developer intervention.
Create a centralized IAM service account, generate a downloadable JSON key file, and configure the GOOGLE_APPLICATION_CREDENTIALS environment variable pointing to the file across all environments.
Grant service agent roles directly to user accounts and compute instances, and enable default project-wide API access scopes across all environments.
Embed OAuth 2.0 refresh tokens directly inside application container images and deploy an internal token-vending proxy to exchange them for long-lived access tokens.