GCP Professional Cloud Security Engineer Practice Question

Workload Identity Federation lets external identities-such as the OIDC tokens from GitLab runners or the SAML/OIDC credentials developers already use-exchange their native credential for a short-lived Google Cloud access token that impersonates a dedicated service account. No JSON key files are created or stored locally, so the policy banning long-lived credentials is met. Each workload or user can be mapped to the minimum-privilege service account needed, and every token issuance is logged in Cloud Audit Logs for traceability. The other approaches continue to rely on long-lived service account keys, grant excessive permissions, or introduce unnecessary operational complexity, so they do not fully mitigate the risk the security team identified.