Workload identity federation in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Workload Identity Federation Basics

What is the primary benefit of using Workload Identity Federation in Google Cloud?

A It allows external workloads to access Google Cloud resources without using long-lived service account keys.

B It automatically encrypts all data stored in Google Cloud Storage buckets.

C It enables Google Cloud services to run workloads on-premises without internet access.

D It provides a graphical interface to manage Google Cloud IAM roles.

💡 Hint

Think about how external systems can securely access Google Cloud without managing keys.

Workload Identity Federation lets external identities access Google Cloud resources without needing to manage service account keys, improving security and ease of use.

❓ Configuration

intermediate

Configuring a Workload Identity Pool Provider

You want to configure a Workload Identity Pool provider to trust an external OIDC identity provider. Which configuration element is mandatory to specify in the provider setup?

A The Google Cloud project billing account ID.

B The issuer URI of the external OIDC identity provider.

C The IP address of the external workload.

D The encryption key used for Google Cloud Storage.

💡 Hint

Consider what uniquely identifies the external identity provider in OIDC.

The issuer URI is required to identify and trust the external OIDC identity provider in the Workload Identity Pool provider configuration.

❓ Architecture

advanced

Designing Secure Access with Workload Identity Federation

You have an application running on AWS that needs to access Google Cloud Storage securely without using service account keys. Which architecture best follows Workload Identity Federation best practices?

A Manually copy files from AWS to Google Cloud Storage using a local machine with gcloud CLI.

B Generate a Google Cloud service account key and store it in AWS Secrets Manager for the application to use.

C Use a VPN to connect AWS to Google Cloud and allow access via internal IPs without authentication.

D Create a Workload Identity Pool in Google Cloud, configure an AWS provider with the AWS account ID, and grant the pool access to the required Cloud Storage roles.

💡 Hint

Think about how to avoid managing keys and use identity federation instead.

Using a Workload Identity Pool with an AWS provider allows the AWS workload to authenticate to Google Cloud securely without keys, following best practices.

❓ security

advanced

Security Implications of Workload Identity Federation

Which of the following is a key security advantage of using Workload Identity Federation over traditional service account keys?

A It eliminates the need to distribute and rotate long-lived service account keys, reducing risk of key leakage.

B It automatically encrypts all network traffic between Google Cloud and external workloads.

C It allows anonymous access to Google Cloud resources for faster development.

D It disables audit logging for external workload access to improve performance.

💡 Hint

Consider how key management affects security risks.

Workload Identity Federation removes the need for long-lived keys, which are a common source of security breaches if leaked or mishandled.

❓ service_behavior

expert

Behavior of Token Exchange in Workload Identity Federation

When an external workload exchanges its identity token for a Google Cloud access token using Workload Identity Federation, what happens if the token audience does not match the configured audience in the Workload Identity Pool provider?

A Google Cloud ignores the audience and issues an access token anyway.

B The token exchange succeeds but logs a warning for auditing purposes.

C The token exchange fails and Google Cloud denies access due to audience mismatch.

D The external workload is granted limited read-only access automatically.

💡 Hint

Think about how strict identity verification is in token exchanges.

If the token audience does not match the configured audience, Google Cloud rejects the token exchange to prevent unauthorized access.