Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
A security engineer is configuring Workforce Identity Federation to grant external contractors access to Google Cloud resources using their corporate OpenID Connect (OIDC) identity provider, eliminating the need to synchronize user accounts to Cloud Identity.
After creating the workforce pool and configuring the OIDC provider with the appropriate issuer URL, client ID, client secret, and attribute mappings, the engineer must enable the contractors to authenticate securely through the Google Cloud CLI (gcloud) using interactive browser-based sign-in.
Which command should the security engineer execute to generate the configuration file required for browser-based sign-in?
gcloud iam workforce-pools create-cred-config locations/global/workforcePools/WORKFORCE_POOL_ID/providers/PROVIDER_ID --subject-token-type="urn:ietf:params:oauth:token-type:id_token" --credential-source-file="id_token.json" --workforce-pool-user-project="PROJECT_NUMBER" --output-file="config.json".create-cred-config isThe gcloud iam workforce-pools create-cred-config command creates a credential configuration file specifically intended for non-interactive (headless) programmatic sign-in and service-to-service workloads using external tokens.
--credential-source-file) and a specified subject token type (--subject-token-type), rather than launching an interactive browser-based authentication flow.auth_url) metadata needed by the gcloud auth login browser workflow.--workforce-pool-user-project parameter with serviceusage.services.use permissions to bill and quota API usage.The scenario required setting up automated background scripts or headless CLI sign-in where an OIDC ID token is acquired programmatically and exchanged via local files rather than an interactive web browser.
gcloud auth application-default login --scopes="https://www.googleapis.com/auth/cloud-platform" --client-id-file="client_secret.json".gcloud auth application-default login doesThe gcloud auth application-default login command obtains Application Default Credentials (ADC) for local developer environments using standard Google user credentials or custom OAuth client IDs, saving credentials to the well-known ADC file path.
accounts.google.com) or custom OAuth 2.0 web applications rather than a Google Cloud Workforce Identity Pool resource.A developer needed to obtain local Application Default Credentials for client library development using an existing managed Google account rather than Workforce Identity Federation.
gcloud iam workforce-pools create-login-config locations/global/workforcePools/WORKFORCE_POOL_ID/providers/PROVIDER_ID --output-file=login.json.gcloud iam workforce-pools create-login-config isThe gcloud iam workforce-pools create-login-config command generates a client-side configuration file containing the necessary authorization endpoints and audience URI to facilitate interactive, browser-based authentication for external identities using Workforce Identity Federation.
https://auth.cloud.google/authorize), Security Token Service endpoints (token_url and token_info_url), and the external account audience matching the workforce pool provider.gcloud sign-in: Users can initiate interactive authentication by executing gcloud auth login --login-config=login.json or by activating the file with gcloud config set auth/login_config_file login.json.//iam.googleapis.com/locations/global/workforcePools/WORKFORCE_POOL_ID/providers/PROVIDER_ID) as the target audience.gcloud CLI, the browser, Google's authorization endpoint, and the external identity provider.Generating a login configuration via create-login-config is the standard, documented method in Google Cloud for interactive browser-based workforce federation. It explicitly prepares the client environment to redirect to the configured external identity provider for credential challenge and returns the federated token to the CLI.
gcloud config set auth/login_config_file "https://iam.googleapis.com/v1/workforcePools/WORKFORCE_POOL_ID/providers/PROVIDER_ID".gcloud config set auth/login_config_file doesThe gcloud config set auth/login_config_file property sets the local CLI path to a pre-generated JSON configuration file so that subsequent gcloud auth login executions automatically read the appropriate federation metadata.
auth_url, token_url, and audience.gcloud authentication engine.create-login-config has already written the login configuration to disk.The login configuration file had already been created on the local file system (e.g., /path/to/login.json) and the administrator simply wanted to set it as the default login configuration for the gcloud CLI.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated