Configuring Access and Security
Free Google Cloud Certified - Associate Cloud Engineer practice — 6 questions on Configuring Access and Security, with explanations. No sign-up. Full 12-question mixed test →
A contractor's automation script running on Compute Engine needs to call APIs as a service account named data-pipeline-sa@project.iam.gserviceaccount.com, but company policy prohibits downloading or distributing service account key files. The contractor's own user account already has the Editor role on the project. What is the correct way to let the contractor's user account act as data-pipeline-sa without creating a key file?
Service account impersonation requires the principal to hold roles/iam.serviceAccountTokenCreator on the target service account (or a role containing that permission). Once granted, the user can run gcloud commands with --impersonate-service-account or generate short-lived tokens via generateAccessToken, with no key file ever created or downloaded.
You need to grant a third-party auditor's group temporary read-only access (roles/viewer) to a project, but the access must automatically stop working after exactly 30 days without requiring anyone to manually revoke the IAM binding. Which approach satisfies this with the least operational overhead?
IAM Conditions allow attaching a CEL (Common Expression Language) expression, such as a request.time comparison against an expiration timestamp, directly to a role binding. Once the condition evaluates false, the binding no longer grants access — no manual cleanup or external automation is required.
A team lead runs `gcloud iam roles create customReader --project=my-project --permissions=storage.objects.get,storage.objects.list` without specifying a --stage flag. What launch stage will the resulting custom role have by default?
When creating a custom role via gcloud iam roles create without an explicit --stage flag, the default launch stage is ALPHA. Roles in ALPHA stage are functional but marked as not production-ready and Google recommends explicitly setting the stage for clarity; this default is a specific detail the exam tests.
Your security team wants to enforce, at the organization level, that no user or service account anywhere in the org can ever create a new user-managed service account key (JSON or P12), forcing all workloads to use Workload Identity or impersonation instead. Which control should they apply?
constraints/iam.disableServiceAccountKeyCreation is a boolean organization policy that, when enforced at the org node, blocks creation of new user-managed service account keys across all projects and folders that inherit the policy, which is exactly the described requirement.
A compliance auditor asks you to produce a log showing every time a specific object inside a Cloud Storage bucket was read (downloaded) over the past week, including by service accounts. Which Cloud Audit Logs log type contains this information, and what must be true for it to exist?
Reading (downloading) an object's data is a data access operation, captured in Data Access audit logs. Unlike Admin Activity logs, Data Access logs for most services (including Cloud Storage) are disabled by default and must be explicitly enabled due to their volume and potential cost, which the exam tests as a key distinction.
A folder named Finance contains Project A, where a user has been granted roles/editor directly at the project level. Leadership now wants to guarantee that this specific user can never access Project A's resources, even if someone later grants them additional roles on Project A in the future, without changing or removing their existing Editor binding elsewhere in the org. Which mechanism should you use?
IAM Deny policies are evaluated before allow policies and take precedence regardless of what allow bindings exist or are added later, at any level of the hierarchy. Creating a deny policy targeting that specific user on Project A (or an ancestor like the Finance folder) guarantees they cannot access the project's resources, satisfying a 'future-proof' block without touching the existing Editor binding.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$99.99 $34.99 with code FREETEST33 — valid through September 14.
Get my $34.99 deal →