Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
An enterprise operates automated, long-running data processing pipelines deployed across Compute Engine instances and Google Kubernetes Engine (GKE) clusters. These workloads continuously ingest data from Cloud Storage buckets and write analytics results into BigQuery datasets without end-user interaction. The security team previously discovered that some pipelines failed because they relied on human developer credentials that were suspended during employee offboarding.
Which identity architecture should the organization implement to ensure stable, long-term authorization independent of user account lifecycles while enforcing the principle of least privilege?
Google Cloud service accounts provide dedicated, non-human identities designed specifically for applications, automated processes, and long-running compute workloads. When workloads run on Google-managed compute infrastructure such as Compute Engine or Google Kubernetes Engine (GKE), service accounts serve as the identity foundation that decouples application access from human user accounts and interactive sign-in flows.
StudyCerts
StudyCertsroles/storage.objectViewer and roles/bigquery.dataEditor), preventing excessive access sprawl.This approach aligns with Google Cloud's established security best practices for automated workloads, ensuring high availability, zero dependence on human credentials, and fine-grained access control.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.