Service account keys management in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding service account key rotation

Why is it important to rotate service account keys regularly in Google Cloud Platform?

A To automatically upgrade the service account permissions

B To increase the number of active keys for better performance

C To permanently disable the service account

D To reduce the risk of unauthorized access if a key is compromised

💡 Hint

Think about what happens if a key is leaked or stolen.

Rotating keys reduces the chance that a compromised key can be used indefinitely. Old keys should be deleted after rotation.

❓ Configuration

intermediate

Identifying valid service account key creation command

Which gcloud command correctly creates a new JSON key for a service account named [e-mail]?

A gcloud iam keys create key.json --service-account=[e-mail]

B gcloud iam service-accounts keys create key.json --iam-account=[e-mail]

C gcloud iam service-accounts create key.json --account=[e-mail]

D gcloud service-accounts keys create key.json --account=[e-mail]

💡 Hint

Check the correct gcloud subcommand and flag names for key creation.

The correct command uses gcloud iam service-accounts keys create with the --iam-account flag.

❓ security

advanced

Impact of leaked service account keys

If a service account key is leaked publicly, what is the immediate risk?

A Anyone with the key can authenticate as the service account and access resources allowed by its permissions

B The service account will be automatically disabled by Google Cloud

C The key will expire immediately and become unusable

D The service account's permissions will be revoked automatically

💡 Hint

Consider what a key allows in terms of authentication and access.

A leaked key allows attackers to impersonate the service account until the key is revoked or deleted.

✅ Best Practice

advanced

Recommended practice for service account key storage

What is the best practice for storing service account keys to minimize security risks?

A Email keys to team members for backup

B Store keys in plain text files on developer machines for easy access

C Store keys in a secure secret manager and avoid embedding them in code or public repositories

D Upload keys to public cloud storage buckets for sharing

💡 Hint

Think about how to keep keys safe and prevent accidental exposure.

Using secret managers protects keys with access controls and auditing, reducing risk of leaks.

❓ service_behavior

expert

Effect of deleting a service account key on running workloads

What happens to running workloads that use a service account key if that key is deleted from Google Cloud?

A Workloads using the deleted key will lose authentication and fail to access Google Cloud resources immediately

B Workloads continue to run normally because keys are cached indefinitely

C Google Cloud automatically issues a new key to running workloads

D Workloads switch to using the service account's default credentials automatically

💡 Hint

Consider how authentication tokens depend on keys and their validity.

Deleting a key invalidates it immediately, causing authentication failures for workloads using it.