Google
PROFESSIONAL-CLOUD-ARCHITECT · Question #131
Your company pushes batches of sensitive transaction data from its application server VMs to Cloud Pub/ Sub for processing and storage. What is the Google-recommended way for your application to…
The correct answer is A. Ensure that VM service accounts are granted the appropriate Cloud Pub/Sub IAM roles. https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances The service account can only execute API methods that are allowed by both the access scope and the service account's specific IAM roles.
Submitted by sofia.br· Mar 30, 2026Designing for security and compliance
Question
Your company pushes batches of sensitive transaction data from its application server VMs to Cloud Pub/ Sub for processing and storage. What is the Google-recommended way for your application to authenticate to the required Google Cloud services?
Options
- AEnsure that VM service accounts are granted the appropriate Cloud Pub/Sub IAM roles.
- BEnsure that VM service accounts do not have access to Cloud Pub/Sub, and use VM access
- CGenerate an OAuth2 access token for accessing Cloud Pub/Sub, encrypt it, and store it in Cloud
- DCreate a gateway to Cloud Pub/Sub using a Cloud Function, and grant the Cloud Function
How the community answered
(50 responses)- A94% (47)
- B2% (1)
- C4% (2)
Explanation
https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances The service account can only execute API methods that are allowed by both the access scope and the service account's specific IAM roles.
Topics
#service accounts#Cloud Pub/Sub#IAM roles#VM authentication
Community Discussion
No community discussion yet for this question.