Exam Associate Cloud Engineer topic 1 question 301 discussion

Actual exam question from Google's Associate Cloud Engineer

Question #: 301
Topic #: 1

[All Associate Cloud Engineer Questions]

You are deploying an application to Google Kubernetes Engine (GKE). The application needs to make API calls to a private Cloud Storage bucket. You need to configure your application Pods to authenticate to the Cloud Storage API, but your organization policy prevents the usage of service account keys. You want to follow Google-recommended practices. What should you do?

A. Create the GKE cluster with Workload Identity Federation. Configure the default node service account to access the bucket. Deploy the application into the cluster so the application can use the node service account permissions. Use Identity and Access Management (IAM) to grant the service account access to the bucket.
B. Create the GKE cluster with Workload Identity Federation. Create a Google service account and a Kubernetes ServiceAccount, and configure both service accounts to use Workload Identity Federation. Attach the Kubernetes ServiceAccount to the application Pods and configure the Google service account to access the bucket with Identity and Access Management (IAM).
C. Create the GKE cluster and deploy the application. Request a security exception to create a Google service account key. Set the constraints/iam.serviceAccountKeyExpiryHours organization policy to 24 hours.
D. Create the GKE cluster and deploy the application. Request a security exception to create a Google service account key. Set the constraints/iam.serviceAccountKeyExpiryHours organization policy to 8 hours.

Show Suggested Answer

Suggested Answer: B 🗳️

by MohannadSamir at May 18, 2025, 2:15 p.m.

Comments

Submit Cancel

MohannadSamir

1 month ago

Selected Answer: B

Workload Identity is Google's recommended way to access Google Cloud services from within GKE applications. It's more secure than using service account keys and follows security best practices.

upvoted 2 times

...