Service account keys management in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding service account key rotation

Why is it important to rotate service account keys regularly in Google Cloud Platform?

A To automatically upgrade the service account permissions

B To increase the number of active keys for better performance

C To permanently disable the service account

D To reduce the risk of unauthorized access if a key is compromised

💡 Hint

Think about what happens if a key is leaked or stolen.

Rotating keys reduces the chance that a compromised key can be used indefinitely. Old keys should be deleted after rotation.

❓ Configuration

intermediate

Identifying valid service account key creation command

Which gcloud command correctly creates a new JSON key for a service account named [e-mail]?

A gcloud iam keys create key.json --service-account=[e-mail]

B gcloud iam service-accounts keys create key.json --iam-account=[e-mail]

C gcloud iam service-accounts create key.json --account=[e-mail]

D gcloud service-accounts keys create key.json --account=[e-mail]

💡 Hint

Check the correct gcloud subcommand and flag names for key creation.

The correct command uses gcloud iam service-accounts keys create with the --iam-account flag.

❓ security

advanced

Impact of leaked service account keys

If a service account key is leaked publicly, what is the immediate risk?

A Anyone with the key can authenticate as the service account and access resources allowed by its permissions

B The service account will be automatically disabled by Google Cloud

C The key will expire immediately and become unusable

D The service account's permissions will be revoked automatically

💡 Hint

Consider what a key allows in terms of authentication and access.

A leaked key allows attackers to impersonate the service account until the key is revoked or deleted.

✅ Best Practice

advanced

Recommended practice for service account key storage

What is the best practice for storing service account keys to minimize security risks?

A Email keys to team members for backup

B Store keys in plain text files on developer machines for easy access

C Store keys in a secure secret manager and avoid embedding them in code or public repositories

D Upload keys to public cloud storage buckets for sharing

💡 Hint

Think about how to keep keys safe and prevent accidental exposure.

Using secret managers protects keys with access controls and auditing, reducing risk of leaks.

❓ service_behavior

expert

Effect of deleting a service account key on running workloads

What happens to running workloads that use a service account key if that key is deleted from Google Cloud?

A Workloads using the deleted key will lose authentication and fail to access Google Cloud resources immediately

B Workloads continue to run normally because keys are cached indefinitely

C Google Cloud automatically issues a new key to running workloads

D Workloads switch to using the service account's default credentials automatically

💡 Hint

Consider how authentication tokens depend on keys and their validity.

Deleting a key invalidates it immediately, causing authentication failures for workloads using it.

Practice

1. What is the main purpose of a service account key in Google Cloud?

easy

A. To manage billing information for Google Cloud projects

B. To store user passwords for Google Cloud accounts

C. To allow programs to securely access Google Cloud resources

D. To create virtual machines automatically

Solution

1. Step 1: Understand service account keys

   Service account keys are used by programs, not humans, to access Google Cloud securely.

2. Step 2: Identify the correct purpose

   They provide credentials for applications to authenticate and interact with cloud services.

3. Final Answer:

   To allow programs to securely access Google Cloud resources -> Option C

4. Quick Check:

   Service account keys = secure program access [OK]

Hint: Keys let programs access cloud securely, not users [OK]

Common Mistakes:

• Confusing keys with user passwords
• Thinking keys manage billing
• Believing keys create virtual machines

2. Which gcloud command correctly creates a new service account key for the account [e-mail]?

easy

A. gcloud iam service-accounts keys create key.json --iam-account=[e-mail]

B. gcloud iam service-accounts create key.json --account=[e-mail]

C. gcloud service-accounts keys create key.json --account=[e-mail]

D. gcloud iam keys create key.json --iam-account=[e-mail]

Solution

1. Step 1: Identify correct gcloud command syntax

   The correct command to create a key is gcloud iam service-accounts keys create with the --iam-account flag.

2. Step 2: Match the command with the options

   gcloud iam service-accounts keys create key.json --iam-account=[e-mail] matches the correct syntax exactly.

3. Final Answer:

   gcloud iam service-accounts keys create key.json --iam-account=[e-mail] -> Option A

4. Quick Check:

   Correct command syntax = gcloud iam service-accounts keys create key.json --iam-account=[e-mail] [OK]

Hint: Use 'iam service-accounts keys create' with --iam-account [OK]

Common Mistakes:

• Using 'create' without 'keys'
• Wrong flag like --account instead of --iam-account
• Omitting 'iam' in the command

3. What will be the output of the following command?

gcloud iam service-accounts keys list --iam-account=[e-mail]

Assuming there are two active keys for this service account.

medium

A. A prompt to create a new key

B. An error saying no keys found

C. A list of all service accounts in the project

D. A list showing details of the two active keys including key IDs and creation dates

Solution

1. Step 1: Understand the command purpose

   The command lists keys for the specified service account.

2. Step 2: Interpret expected output

   Since two active keys exist, the output will show their details like key IDs and creation dates.

3. Final Answer:

   A list showing details of the two active keys including key IDs and creation dates -> Option D

4. Quick Check:

   Listing keys shows active keys details [OK]

Hint: List keys command shows active keys info [OK]

Common Mistakes:

• Expecting an error if keys exist
• Confusing keys list with service accounts list
• Thinking it prompts for key creation

4. You run the command:

gcloud iam service-accounts keys delete 123abc --iam-account=[e-mail]

But get an error saying the key ID does not exist. What is the most likely cause?

medium

A. The key ID is incorrect or does not belong to the specified service account

B. The service account email is misspelled

C. You need to create a new key before deleting

D. The project ID is missing from the command

Solution

1. Step 1: Analyze the error message

   The error says the key ID does not exist, meaning the key ID is invalid or not linked to the service account.

2. Step 2: Check command components

   The service account email may be correct, and project ID is not required here if default is set. Creating a key before deleting is unnecessary.

3. Final Answer:

   The key ID is incorrect or does not belong to the specified service account -> Option A

4. Quick Check:

   Invalid key ID causes deletion error [OK]

Hint: Check key ID matches service account keys [OK]

Common Mistakes:

• Assuming project ID is mandatory in this command
• Thinking you must create a key before deleting
• Ignoring key ID correctness

5. You want to rotate service account keys to improve security. Which sequence of actions is the best practice?

hard

A. Delete the old key first, then create a new key and update applications

B. Create a new key, update your applications to use it, then delete the old key

C. Create multiple keys and use them all simultaneously without deleting any

D. Keep using the old key until it expires, then create a new key

Solution

1. Step 1: Understand key rotation best practice

   To avoid downtime, first create a new key and update applications to use it.

2. Step 2: Remove old key after update

   Once applications use the new key, delete the old key to reduce risk.

3. Final Answer:

   Create a new key, update your applications to use it, then delete the old key -> Option B

4. Quick Check:

   New key first, then delete old key [OK]

Hint: Add new key before deleting old one to avoid downtime [OK]

Common Mistakes:

• Deleting old key before updating apps
• Using multiple keys unnecessarily
• Waiting for old key to expire before rotating