Service accounts for applications in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding service account roles

You have an application running on Google Cloud that needs to read data from a Cloud Storage bucket but should not modify or delete any data. Which service account role should you assign to the application?

A roles/storage.admin

B roles/storage.objectAdmin

C roles/storage.objectViewer

D roles/owner

💡 Hint

Think about the principle of least privilege: only allow what is necessary.

The roles/storage.objectViewer role allows read-only access to objects in Cloud Storage buckets. It fits the requirement to read data without modifying or deleting it. Other roles provide broader permissions than needed.

❓ Configuration

intermediate

Service account key management

You want to securely provide your application running outside Google Cloud access to a Google Cloud API using a service account. Which method is the best practice for managing the service account key?

A Store the service account key in a secure secret manager and load it at runtime.

B Download the service account JSON key once and embed it directly in the application code.

C Create a new service account key every time the application starts.

D Share the service account key via email to all developers.

💡 Hint

Think about how to keep secrets safe and avoid exposing keys unnecessarily.

Storing the service account key in a secure secret manager and loading it at runtime is best practice. It avoids hardcoding secrets and reduces risk of exposure. Downloading and embedding keys or sharing via email are insecure. Creating new keys frequently is inefficient and can cause key sprawl.

❓ Architecture

advanced

Designing least privilege for multi-service application

You have a multi-service application on Google Cloud. Service A needs to write logs to Cloud Logging. Service B needs to read messages from a Pub/Sub subscription. Both services use separate service accounts. Which is the best way to assign permissions?

A Assign roles/logging.logWriter to Service A's service account and roles/pubsub.subscriber to Service B's service account.

B Assign roles/editor to both service accounts to cover all permissions.

C Assign roles/logging.admin to Service A's service account and roles/pubsub.admin to Service B's service account.

D Assign roles/owner to Service A's service account and roles/pubsub.viewer to Service B's service account.

💡 Hint

Remember to give only the permissions each service needs.

Assigning roles/logging.logWriter to Service A and roles/pubsub.subscriber to Service B follows the principle of least privilege. Using broad roles like editor or owner grants unnecessary permissions and increases security risk. Admin roles provide more permissions than needed.

❓ security

advanced

Detecting compromised service account keys

You suspect a service account key has been compromised. What is the immediate best action to secure your Google Cloud environment?

A Change the service account's password.

B Delete the service account entirely to revoke all access.

C Disable the service account temporarily without deleting keys.

D Rotate the compromised key by deleting it and creating a new key, then update applications.

💡 Hint

Think about how to stop unauthorized access quickly while minimizing disruption.

Rotating the compromised key by deleting it and creating a new one immediately stops unauthorized use of the old key. Deleting the entire service account can cause service disruption. Disabling the account may not revoke keys immediately. Service accounts do not have passwords.

❓ service_behavior

expert

Service account token expiration behavior

An application running on Google Compute Engine uses a service account to access Google Cloud APIs. The application obtains an access token from the metadata server. What happens when the access token expires?

A The application must manually request a new access token from the metadata server to continue API calls.

B The metadata server automatically refreshes the access token, and the application can request a new token anytime without credentials.

C The application must restart the VM to get a new access token.

D The access token never expires while the VM is running.

💡 Hint

Think about how Google Cloud manages tokens for VM service accounts.

The metadata server automatically refreshes access tokens for service accounts attached to Compute Engine VMs. Applications can request new tokens anytime without needing to manage credentials manually. Tokens do expire, but the refresh is seamless. Restarting the VM is not required.