🔥 40% Off Crucial Exams Memberships — Deal ends today!

1 hour, 57 minutes remaining!
Crucial Exams

GCP Associate Cloud Engineer Practice Question

Your organization schedules a Cloud Functions job that writes data to a Cloud Storage bucket using a downloaded JSON service-account key stored in an environment variable. The security team wants to reduce the blast radius if credentials are leaked but still keep the job fully automated and non-interactive. What should you do?

  • Move the JSON key into Secret Manager and have the function read it at startup instead of from an environment variable.

  • Create a new service-account key and schedule automatic key rotation every 90 days with Cloud Scheduler.

  • Refactor the function to call the IAM Credentials API to impersonate the service account and retrieve a short-lived access token at each invocation, then delete the existing service-account key.

  • Encrypt the JSON key with Cloud KMS and rotate the encryption key every 30 days.

GCP Associate Cloud Engineer
Configuring access and security
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot