GCP Professional Cloud Security Engineer Practice Question

Google's best practice is to disable an unused default service account instead of deleting it. Disabling immediately blocks the account from obtaining new OAuth tokens and from creating or using service-account keys, eliminating the risk that its typically broad permissions could be misused. Because disabling does not remove the service account's IAM role bindings, you can re-enable the same identity instantly if you later find that an automated process still needs it, restoring any previous access without recreating roles or redeploying code. Permanently deleting the account would start a 30-day grace period after which the identity is gone and any lingering dependencies would fail; rotating keys or merely adding roles leaves the powerful account active; delegating extra privileges to project editors does nothing to mitigate the account's standing risk.