professional-cloud-data-engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An enterprise data engineering team operates an automated CI/CD pipeline in project-dev-cicd that deploys and executes nightly ETL workflows in project-analytics-prod. The pipeline must read source files from a dedicated Cloud Storage bucket and write processed tables into a specific BigQuery dataset in the analytics project.
Corporate security policy strictly forbids downloading and storing long-lived service account JSON keys and mandates least-privilege resource scoping.
How should you configure Cloud IAM and service account permissions to fulfill these requirements?
Create a dedicated service account in project-analytics-prod with the basic roles/editor role. Grant the CI/CD pipeline service account the roles/iam.serviceAccountUser role on project-analytics-prod.
Create a dedicated service account in project-analytics-prod. Grant it roles/storage.objectViewer on the bucket, roles/bigquery.dataEditor on the target dataset, and roles/bigquery.jobUser on the project. Grant the pipeline service account roles/iam.serviceAccountTokenCreator on the dedicated service account.
Grant the CI/CD pipeline service account roles/bigquery.admin and roles/storage.admin directly at the project level in project-analytics-prod using cross-project IAM bindings.
Create a dedicated service account in project-analytics-prod, export a service account JSON key file, and store it encrypted in Secret Manager. Grant the pipeline service account roles/secretmanager.secretAccessor.
Create a dedicated service account in project-analytics-prod with the basic roles/editor role. Grant the CI/CD pipeline service account the roles/iam.serviceAccountUser role on project-analytics-prod.
Create a dedicated service account in project-analytics-prod. Grant it roles/storage.objectViewer on the bucket, roles/bigquery.dataEditor on the target dataset, and roles/bigquery.jobUser on the project. Grant the pipeline service account roles/iam.serviceAccountTokenCreator on the dedicated service account.
Service account impersonation is an IAM security pattern that allows an authenticated principal (such as a CI/CD runner service account) to temporarily generate short-lived OAuth 2.0 credentials and act on behalf of a target service account. Coupled with fine-grained predefined IAM roles, this approach enforces least privilege at specific resource hierarchy levels rather than across entire projects.
StudyCerts
StudyCertsroles/iam.serviceAccountTokenCreator directly on the target service account, the CI/CD pipeline acquires ephemeral access tokens at runtime via the IAM Credentials API, completely eliminating the need for downloadable JSON service account keys.roles/storage.objectViewer specifically on the target Cloud Storage bucket and roles/bigquery.dataEditor on the specific BigQuery dataset restricts data access to only the necessary resources. The roles/bigquery.jobUser role granted at the project level provides the minimal permission required to execute query and load jobs without granting broad administrative privileges.project-analytics-prod from unauthorized reads and writes.Grant the CI/CD pipeline service account roles/bigquery.admin and roles/storage.admin directly at the project level in project-analytics-prod using cross-project IAM bindings.
Create a dedicated service account in project-analytics-prod, export a service account JSON key file, and store it encrypted in Secret Manager. Grant the pipeline service account roles/secretmanager.secretAccessor.