Crucial Exams

GCP Professional Cloud Architect Practice Question

Your security team mandates that workloads running in a GKE cluster in project "prod-app" must pull container images from an Artifact Registry repository in project "cicd-registry" and write application logs into a BigQuery dataset in project "analytics". You must enforce least privilege, avoid any long-lived credentials on the nodes, and allow future microservices in the cluster to adopt the same pattern without code changes. What should you do?

  • Create a custom IAM role combining Artifact Registry Reader and BigQuery Data Editor, assign it to the DevOps user group in both projects, and inject an access token into each pod at runtime with an init container.

  • Allow GKE nodes to run with the project's default Compute Engine service account and grant that account Artifact Registry Reader on cicd-registry and BigQuery Data Editor on the analytics dataset.

  • Enable Workload Identity on the cluster, create a dedicated Google service account, grant it Artifact Registry Reader on cicd-registry and BigQuery Data Editor on the analytics dataset, and map the cluster's default Kubernetes service account to impersonate this Google service account.

  • Export a JSON key for the Artifact Registry service account in cicd-registry, store it in Secret Manager, and mount the key into pods together with BigQuery credentials for direct use by application code.

GCP Professional Cloud Architect
Designing for security and compliance
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot