Crucial Exams

GCP Associate Cloud Engineer Practice Question

Your company stores sensitive data in a Cloud Storage bucket that is accessible only to a production microservice through its own service account. During an incident, the on-call engineer must run a one-time gsutil cp command from their laptop using the microservice's identity. Security policy forbids distributing long-lived service-account keys and must keep an audit trail showing which human acted. Which approach meets all requirements?

  • Grant the engineer roles/iam.serviceAccountTokenCreator on the microservice's service account and instruct them to run gcloud auth print-access-token --impersonate-service-account before using gsutil.

  • Add the engineer directly to the bucket IAM policy with the Storage Object Viewer role for the duration of the incident, then remove the binding afterward.

  • Create a new JSON key for the service account, store it in Secret Manager, and have the engineer retrieve the key and set the GOOGLE_APPLICATION_CREDENTIALS environment variable.

  • Give the engineer roles/iam.serviceAccountUser on the service account so they can download its existing key from the Cloud Console when needed.

GCP Associate Cloud Engineer
Configuring access and security
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot