Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An enterprise maintains a legacy on-premises continuous integration and continuous deployment (CI/CD) system that cannot support Workload Identity Federation and requires a user-managed service account key to deploy infrastructure to Google Cloud. Security policy mandates:
Which architecture should the security team implement to satisfy these requirements?
Configure Cloud Key Management Service (Cloud KMS) automatic key rotation on a symmetric key that encrypts the service account private key stored in an application configuration file.
Configure Secret Manager with automated rotation schedules targeting a Cloud Function via Pub/Sub, where the function generates a new service account key via the IAM API, adds it as a new secret version, and deletes the prior key after a grace period.
Configure IAM Policy Simulator to run on a 30-day cron schedule, create a new service account key, store the key in a Cloud Storage bucket with Object Versioning, and revoke all IAM roles on the existing key.
Use Cloud Scheduler to invoke a Cloud Build pipeline that deletes the service account, recreates the service account with the same email address, generates a key, and updates Secret Manager.
Configure Cloud Key Management Service (Cloud KMS) automatic key rotation on a symmetric key that encrypts the service account private key stored in an application configuration file.
Configure Secret Manager with automated rotation schedules targeting a Cloud Function via Pub/Sub, where the function generates a new service account key via the IAM API, adds it as a new secret version, and deletes the prior key after a grace period.
Secret Manager provides native support for automated secret rotation by integrating with Cloud Pub/Sub and serverless compute such as Cloud Functions or Cloud Run. This pattern decouples credential consumers from key creation lifecycles, allowing workloads to query the latest version of a secret dynamically while automated background workflows manage creation, delivery, and disposal of underlying credentials.
StudyCerts
StudyCertsprojects.serviceAccounts.keys.create) to generate a new key, and writes the JSON key payload directly as a new secret version using the Secret Manager API (projects.secrets.addVersion). The CI/CD toolchain retrieves projects/{project}/secrets/{secret}/versions/latest at runtime.projects.serviceAccounts.keys.delete.projects.serviceAccounts.keys.disable) or delete the specific compromised key ID and destroy the corresponding Secret Manager version without deleting or modifying the underlying service account identity or its IAM bindings.roles/iam.serviceAccountKeyAdmin on the target service account and roles/secretmanager.admin on the secret, maintaining tight privilege boundaries.This architecture completely automates the service account key lifecycle natively within Google Cloud while keeping external legacy pipelines operational and providing fine-grained incident response capabilities for key invalidation.
Configure IAM Policy Simulator to run on a 30-day cron schedule, create a new service account key, store the key in a Cloud Storage bucket with Object Versioning, and revoke all IAM roles on the existing key.
Use Cloud Scheduler to invoke a Cloud Build pipeline that deletes the service account, recreates the service account with the same email address, generates a key, and updates Secret Manager.