An enterprise DevOps team is configuring automated data migration from Microsoft Azure Blob Storage into Cloud Storage buckets. The organization's security policy enforces strict governance rules across all cloud environments: User-managed service account keys and static cloud credentials (such as Azure Shared Access Signatures or access keys) are strictly prohibited. Authentication between cloud providers must rely entirely on short-lived OpenID Connect (OIDC) tokens and keyless federated identities. The principle of least privilege must be maintained for all automated service identities. Which strategy should the team implement to fulfill these requirements for Storage Transfer Service?

Grant the Service Account Token Creator role to the Storage Transfer Service service agent in Google Cloud, register an application in Azure with a federated credential specifying the service agent's OIDC issuer, and grant that Azure application read access to the storage container.: What Workload Identity Federation for Storage Transfer Service Is Workload Identity Federation enables Google Cloud services and external workloads to securely exchange identity credentials without managing or storing static, long-lived API keys, client secrets, or private key JSON files. For Storage Transfer Service, Google Cloud uses its managed service agent identity to generate short-lived OpenID Connect (OIDC) ID tokens that external identity providers (such as Microsoft Entra ID / Azure AD) validate natively. How It Meets the Security and Migration Requirements Eliminates Long-Lived Keys: No static Azure Storage access keys, SAS tokens, or downloadable Google Cloud service account keys are created or stored. Enforces Short-Lived Tokens: Granting the Service Account Token Creator (roles/iam.serviceAccountTokenCreator) role to the managed Storage Transfer Service service agent (service-PROJECT_NUMBER@gcp-sa-storagetransfer.iam.gserviceaccount.com) allows it to create ephemeral OIDC ID tokens on demand. Establishes Trust via Azure Federated Credentials: Registering an application in Azure and attaching a federated credential with Google's OIDC issuer URL and the service agent's unique subject ID allows Azure to authenticate incoming transfer requests securely. Follows Least Privilege: Permissions on Azure Blob Storage are granted directly to the registered Azure application identity, scoping access exclusively to the target source containers. Key Advantages and Capabilities Zero Secret Sprawl: Eliminates operational overhead and security exposure associated with manual key rotation, secret leaking, and compromised long-lived credentials. Native Integration: Works directly with Storage Transfer Service transfer jobs without custom proxy infrastructure. Auditable Lifecycle: All token exchanges and access requests are logged within Cloud Audit Logs and Azure Activity/Sign-in logs. Standardized Multi-Cloud Architecture: Follows industry-standard OIDC federation patterns across heterogeneous cloud providers. Why This Is Optimal Federating the native Google Cloud service agent with Azure App Registration creates a completely keyless architecture. It satisfies the strict prohibition against static secrets while ensuring minimal administrative maintenance.

Storage Transfer Service Workload Identity Azure | Professional Cloud DevOps Engineer

AdvancedProfessional Cloud DevOps Engineer

Your enterprise organization is establishing baseline security and lifecycle standards for Identity and Access Management (IAM) across its Google Cloud resource hierarchy. The DevOps engineering team is tasked with defining standard operating procedures for provisioning new workload identities, managing default service accounts, and retiring decommissioned service accounts. The strategy must satisfy the following architectural requirements: Prevent newly created projects from automatically granting permissive Editor roles to default service accounts. Establish a standardized naming and configuration pattern for Compute Engine workload identities to maintain traceability and least privilege. Define a safe decommissioning lifecycle for obsolete application service accounts that prevents accidental permanent authorization loss and supports rapid rollback. Which strategy should the DevOps team implement?

Creating and managing service accounts

AdvancedProfessional Cloud DevOps Engineer

Your enterprise organization is establishing a secure operational framework for service account usage across its development teams. You must configure IAM permissions to support two distinct operational requirements while strictly enforcing the principle of least privilege: Requirement 1: A designated group of engineers (devops-leads@example.com) must be able to impersonate a production deployment service account (prod-deployer@project-id.iam.gserviceaccount.com) from the Google Cloud CLI to obtain short-lived OAuth 2.0 access tokens for emergency rollouts without managing static keys. Requirement 2: A broader team of developers (app-devs@example.com) must be able to provision Compute Engine virtual machines that run workloads under a dedicated workload service account (app-runner@project-id.iam.gserviceaccount.com), but they must not be permitted to directly generate credentials or mint tokens for this workload service account from their local workstations. Which IAM role bindings should you configure?

Creating and managing service accounts

AdvancedProfessional Cloud DevOps Engineer

An enterprise is designing its Google Cloud resource hierarchy to support multiple development teams while meeting strict security, compliance, and operational governance requirements: Centralized Network & Security Control: Dedicated central network and security teams must manage Shared VPC host infrastructure, hierarchical firewall policies, and organizational guardrails across all workloads. Environment Isolation & Access Control: Developers need administrative permissions within Development environments to rapidly iterate, but must have strictly restricted, read-only permissions in Production where changes are deployed exclusively through CI/CD service accounts. Policy Enforcement: Strict organizational policy constraints (such as disabling external IP addresses) must apply to all production workloads across all applications, while remaining permissive in development. Safe Governance Validation: The DevOps team must be able to validate changes to organization policies, access policies, and resource hierarchy restructuring before applying them to the live organization. Which resource hierarchy and access architecture should the team implement?

Organizing resources (e.g., application-centric, projects, folders)

AdvancedProfessional Cloud DevOps Engineer

An e-commerce platform hosted on Google Cloud experiences periodic flash-sale traffic surges that can exhaust Compute Engine regional vCPU quotas and cause capacity constraints in the primary region (us-central1). The Site Reliability Engineering (SRE) team needs to implement an automated multi-region capacity scaling and rapid failover strategy. The solution must: Ensure client requests automatically overflow to a secondary region (us-east4) as soon as the primary region reaches backend capacity or quota limits. Avoid client-side DNS caching delays during localized saturation incidents. Maintain high availability and automated traffic distribution based on real-time backend capacity. Which architectural strategy should the SRE team implement?

Adding capacity

AdvancedProfessional Cloud DevOps Engineer

An e-commerce organization runs a legacy order processing service that outputs structured JSON logs to stdout. The operations team needs to define a Service Level Indicator (SLI) to track the 95th and 99th percentile latency across different checkout categories without refactoring the application code to add OpenTelemetry or Prometheus metric client libraries. A sample log payload emitted by the service contains: { "message": "Order processed successfully", "transaction_type": "express_checkout", "duration_ms": 245.8 } How should the DevOps engineer configure Google Cloud Observability to generate the required latency SLI metrics?

Creating custom metrics, including log-based metrics

FundamentalAssociate Data Practitioner

BigQuery ML K-means Clustering

Execute SQL to create, train, and evaluate models using BigQuery ML

Professional Cloud DevOps Engineer

Storage Transfer Service Workload Identity Azure

Related questions

BigQuery ML K-means Clustering

Professional Cloud DevOps Engineer

Storage Transfer Service Workload Identity Azure

What Workload Identity Federation for Storage Transfer Service Is

How It Meets the Security and Migration Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions

BigQuery ML K-means Clustering

What Workload Identity Federation for Storage Transfer Service Is

How It Meets the Security and Migration Requirements

Key Advantages and Capabilities

Why This Is Optimal