Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
An enterprise executes automated CI/CD deployment pipelines on an external computing platform. The security architecture team requires that external workloads access Google Cloud resources to deploy infrastructure across multiple projects without using downloadable service account keys. Furthermore, the team mandates that service account impersonation must be strictly restricted to jobs originating from specific repositories and branch references asserted in the external identity provider's token.
Which strategy should the security engineer implement to establish this federation trust relationship?
Workload Identity Federation is a Google Cloud Identity and Access Management (IAM) mechanism that allows workloads running outside Google Cloud (such as multi-cloud environments, on-premises data centers, or CI/CD platforms) to authenticate directly to Google Cloud APIs using short-lived credentials derived from their native identity providers (IdPs).
StudyCerts
StudyCertsattribute.repository, attribute.ref). Granting the Workload Identity User role (roles/iam.workloadIdentityUser) on the specific Google Cloud service account to a filtered principalSet://iam.googleapis.com/.../attribute.repository/REPO_NAME or principal:// ensures that only authorized jobs matching the exact branch and repository criteria can impersonate the service account.This architecture establishes a secure, standard-compliant trust federation directly at the IAM layer, meeting all zero-trust compliance standards without requiring custom credential broker infrastructure or synchronization tooling.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.