Google
ASSOCIATE-CLOUD-ENGINEER · Question #299
You recently discovered that your developers are using many service account keys during their development process. While you work on a long term improvement, you need to quickly implement a process…
The correct answer is C. Enforce an org policy constraint allowing the lifetime of service account keys to be 24 hours. You can use an org policy to enforce a 24-hour lifetime for service account keys. You can use an org policy to deny service account key creation, with an exception for the pj-sa This is a Google-recommended solution and it is relatively inexpensive.
Submitted by mateo_ar· Mar 30, 2026Configuring access and security
Question
You recently discovered that your developers are using many service account keys during their development process. While you work on a long term improvement, you need to quickly implement a process to enforce short-lived service account credentials in your company. You have the following requirements: - All service accounts that require a key should be created in a centralized project called pj-sa. - Service account keys should only be valid for one day. You need a Google-recommended solution that minimizes cost. What should you do?
Options
- AImplement a Cloud Run job to rotate all service account keys periodically in pj-sa. Enforce an org
- BImplement a Kubernetes CronJob to rotate all service account keys periodically. Disable
- CEnforce an org policy constraint allowing the lifetime of service account keys to be 24 hours.
- DEnforce a DENY org policy constraint over the lifetime of service account keys for 24 hours.
How the community answered
(24 responses)- A17% (4)
- B21% (5)
- C54% (13)
- D8% (2)
Explanation
You can use an org policy to enforce a 24-hour lifetime for service account keys. You can use an org policy to deny service account key creation, with an exception for the pj-sa This is a Google-recommended solution and it is relatively inexpensive.
Topics
#service account keys#org policy#key lifetime#security
Community Discussion
No community discussion yet for this question.