nerdexam
Google

PROFESSIONAL-CLOUD-ARCHITECT · Question #184

Case Study: 8 - Mountkirk Games, C Company overview Mountkirk Games makes online, session-based, multiplayer games for mobile platforms. They have recently started expanding to other platforms after…

The correct answer is C. Create a service account (SA) in the legacy game's Google Cloud project, add this SA in the new. Cross-project Cloud Storage access is correctly granted by adding the source project's service account as a principal in the destination project's IAM policy with the appropriate Storage role.

Submitted by jakub_pl· Mar 30, 2026Designing for security and compliance

Question

Case Study: 8 - Mountkirk Games, C Company overview Mountkirk Games makes online, session-based, multiplayer games for mobile platforms. They have recently started expanding to other platforms after successfully migrating their on-premises environments to Google Cloud. Their most recent endeavor is to create a retro-style first-person shooter (FPS) game that allows hundreds of simultaneous players to join a geo-specific digital arena from multiple platforms and locations. A real-time digital banner will display a global leaderboard of all the top players across every active arena. Solution concept Mountkirk Games is building a new multiplayer game that they expect to be very popular. They plan to deploy the game's backend on Google Kubernetes Engine so they can scale rapidly and use Google's global load balancer to route players to the closest regional game arenas. In order to keep the global leader board in sync, they plan to use a multi-region Spanner cluster. Existing technical environment The existing environment was recently migrated to Google Cloud, and five games came across using lift-and-shift virtual machine migrations, with a few minor exceptions. Each new game exists in an isolated Google Cloud project nested below a folder that maintains most of the permissions and network policies. Legacy games with low traffic have been consolidated into a single project. There are also separate environments for development and testing. Business requirements Support multiple gaming platforms. Support multiple regions. Support rapid iteration of game features. Minimize latency. Optimize for dynamic scaling. Use managed services and pooled resources. Minimize costs. Technical requirements Dynamically scale based on game activity. Publish scoring data on a near real-time global leaderboard. Store game activity logs in structured files for future analysis. Use GPU processing to render graphics server-side for multi-platform support. Support eventual migration of legacy games to this new platform. Executive statement Our last game was the first time we used Google Cloud, and it was a tremendous success. We were able to analyze player behavior and game telemetry in ways that we never could before. This success allowed us to bet on a full migration to the cloud and to start building all-new games using cloud-native design principles. Our new game is our most ambitious to date and will open up doors for us to support more gaming platforms beyond mobile. Latency is our top priority, although cost management is the next most important challenge. As with our first cloud-based game, we have grown to expect the cloud to enable advanced analytics capabilities so we can rapidly iterate on our deployments of bug fixes and new functionality. You are implementing Firestore for Mountkirk Games. Mountkirk Games wants to give a new game programmatic access to a legacy game's Firestore database. Access should be as restricted as possible. What should you do?

Options

  • ACreate a service account (SA) in the legacy game's Google Cloud project, add a second SA in the
  • BCreate a service account (SA) in the legacy game's Google Cloud project, give the SA the
  • CCreate a service account (SA) in the legacy game's Google Cloud project, add this SA in the new
  • DCreate a service account (SA) in the legacy game's Google Cloud project, give it the Firebase

How the community answered

(16 responses)
  • A
    19% (3)
  • B
    31% (5)
  • C
    44% (7)
  • D
    6% (1)

Why each option

Cross-project Cloud Storage access is correctly granted by adding the source project's service account as a principal in the destination project's IAM policy with the appropriate Storage role.

ACreate a service account (SA) in the legacy game's Google Cloud project, add a second SA in the

Adding a second service account in the new project and trying to link them does not create a valid cross-project IAM binding; each project's SA is independent and cannot delegate permissions to another project's SA this way.

BCreate a service account (SA) in the legacy game's Google Cloud project, give the SA the

Giving the source project's SA permissions within the same source project does not grant access to resources in the destination (new game's) project.

CCreate a service account (SA) in the legacy game's Google Cloud project, add this SA in the newCorrect

Creating a service account in the legacy game's project and then adding that SA as a principal in the new game's project IAM policy with the Storage Object Viewer (or equivalent) role follows GCP's recommended cross-project access pattern; the SA authenticates with its own project's credentials while the resource-level IAM binding in the destination project grants the actual access, avoiding key file management and following least-privilege principles.

DCreate a service account (SA) in the legacy game's Google Cloud project, give it the Firebase

Firebase Admin SDK roles are application-level roles for Firebase services and are not the correct mechanism for granting cross-project Cloud Storage access between two GKE-based game backends.

Concept tested: Cross-project IAM service account access to Cloud Storage

Source: https://cloud.google.com/iam/docs/best-practices-service-accounts#cross-project

Topics

#service accounts#cross-project IAM#project-level binding#identity federation

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-ARCHITECT Practice