Crucial Exams

GCP Associate Cloud Engineer Practice Question

In a GKE cluster where Workload Identity is already enabled, you create the Google service account [email protected] and grant it the Storage Object Admin role on a Cloud Storage bucket. You then create the Kubernetes service account log-writer in the default namespace and annotate it so that it should act as the GSA. Pods running with this KSA still receive PERMISSION_DENIED errors when they call the Cloud Storage API. Following Google-recommended practices, what should you do to fix the problem?

  • Grant the member serviceAccount:PROJECT_ID.svc.id.goog[default/log-writer] the role roles/iam.workloadIdentityUser on [email protected].

  • Move the iam.gke.io/gcp-service-account annotation from the KSA to each Pod that needs Cloud Storage access.

  • Download a JSON key for [email protected] and mount it in the Pod via a Kubernetes Secret.

  • Bind the Storage Object Admin role directly to the log-writer Kubernetes service account in Cloud IAM.

GCP Associate Cloud Engineer
Configuring access and security
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot